Conti Ransomware Group Diaries, Part III: Weaponry
Summary: Leaked internal Conti chats show the ransomware group, which Chainalysis says generated at least $180 million in revenue last year and grew to 65-100+ employees, spent thousands of dollars monthly on commercial security and antivirus tools to test its malware and on EDR products like Sentinel, Cylance and CrowdStrike to monitor its own administrators. Conti also bought a $60,000 Cobalt Strike license through a legitimate company, subscribed to OSINT services and Crunchbase Pro and Zoominfo to size ransom demands against victim revenue, and worked with a Romanian negotiator nicknamed "The Spaniard" employed by a Canadian ransomware recovery firm.
Key Takeaway: Conti set ransom demands as a percentage of victim annual revenue and used commercial data services to learn a target's insurance coverage and board contacts, so the tools a security leader relies on for defense and the data brokers they trust are part of the attacker's pricing model.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026