Conti and Hive ransomware operations: What we learned from these groups' victim chats
Summary: Cisco Talos researchers spent weeks examining previously unpublished chat logs between the Conti and Hive ransomware gangs and their victims, and released a research paper on how the groups choose targets, negotiate, and operate internally. The same text notes Talos observed abuse of more than 25 legitimate platforms over the past year and identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States, with recovered artifacts showing interest in water resources and energy.
Bottom line: The negotiation transcripts show how these ransomware-as-a-service operations actually pick and pressure victims, and the same research counts more than 25 legitimate platforms turned into delivery mechanisms - the trusted services your users already rely on.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026