Conti Ransomware Group Diaries, Part I: Evasion
Summary: A Ukrainian security researcher leaked years of internal Conti chat logs, from January 2021 to the present and from June to November 2020, after the Russian ransomware group pledged 'full support' for Russia's invasion of Ukraine. The logs show Conti detected the NSA's September 2020 Trickbot takeover within hours, rebuilt to 428 infected U.S. medical facilities by late October 2020, and reorganized after the January 2021 Emotet takedown.
What's compelling: Conti's own manager wrote 'Fuck the clinics in the USA this week' and counted 428 hospitals as the panic target - and the leaked chats include ransom payments from victim companies that never disclosed a breach.
Read the original at Krebs on Security ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026