The strongest ransomware group Conti's internal chats leaked, exposing multiple extortion tactics

With its super strong attack capability and profitability, Conti has become the most successful ransomware group to date, frequently demanding millions of dollars in ransom from victim organisations. The reason for its success is that compared with other ransomware companies, Conti focuses more on companies with an annual revenue of over USD 100 million.

Image source: Chainalysis

At the same time, Conti has joined the ranks of those with revenues exceeding 100 million. According to the latest "Crypto Crime Report" released by virtual currency tracking firm Chainalysis, Conti's revenue last year was at least USD 180 million.

Conti's success is not accidental. As a criminal group, it operates like a developing enterprise, doing everything it can in terms of management and operations to maximize its lethality.

▌To fight outside, we must first settle the inside

The ransomware group tells you: Security validation is crucial

On 27 February, a Ukrainian cybersecurity researcher leaked nearly two years of Conti's internal chat logs. The chat logs showed that this ransomware group, which scales between 65 and 100 people, spends thousands of dollars in budget each month to purchase large amounts of security software and antivirus software. Conti's search and use of these software tools is both to continuously validate the effectiveness of attacks against various products and for internal security.

Chat logs from 8 August 2021 show that superior manager Reshaev ordered subordinate Pin to secretly check the activities of network administrators weekly and install Endpoint Detection and Response (EDR) tools on each administrator's computer to ensure they were not engaging in any activities that would undermine the group's operations.

In addition to checking the activities of administrators on servers weekly and installing EDR (e.g., Sentinel, Cylance, CrowdStrike) on each computer, Reshaev also requested the establishment of a more complex storage system, protection of the LSAS stack on all computers, ensuring only 1 active account, keeping security software updated to the latest version, and installing firewalls on all networks.

Conti's managers are well aware that their employees handle highly sensitive and valuable data stolen from companies, information that would sell like hotcakes on dark web cybercrime forums. But in a company run by crooks, trust is hard to come by.

"You're always checking up on me, don't you trust me?" Bio, a mid-level member, expressed his dissatisfaction upon discovering that manager Tramp was spying on him while he was processing a large Bitcoin transfer ransom.

But Tramp dismissed this with contempt: "How can you completely trust someone who has never seen so much money suddenly encounter a huge sum? I've been doing this for 15 years, and I've seen it all."

▌To master information is to master wealth

Using open-source intelligence, paying for information

Conti has invested a significant budget in Open Source Intelligence (OSINT) tools. For example, it subscribes to many services that help determine the identity of the user of a specific IP address, or confirm whether an IP address is associated with a known Virtual Private Network (VPN) service. Conti has access to tens of thousands of compromised endpoints on an average day, and these OSINT services act as a filter, allowing Conti to focus on compromised systems within large corporate networks.

Conti's open-source intelligence activities also involve commercial services that help Conti gain the upper hand in ransom negotiations with victim companies. Conti often sets ransom demands as a percentage of the victim company's annual revenue, and will harass board members and investors of companies that refuse to engage or negotiate.

In October 2021, Bloodrush, a member of Conti, told his manager Bentley that the company urgently needed subscriptions to Crunchbase Pro and Zoominfo services, because these services could provide detailed information on millions of companies, including the amount of insurance a company holds, the latest profit forecasts, and contact details for management and board members.

In a long-term project last year, Conti invested USD 60,000 to purchase a license for Cobalt Strike, a commercial network penetration testing and reconnaissance tool sold only to vetted partners. Cybercriminal gangs frequently abuse stolen or illegally obtained "Cobalt" licenses to install ransomware on target systems. Of this budget, only USD 3 was the actual cost of the Cobalt Strike license, while the other half was paid to legitimate companies that secretly purchased the license "on behalf of" Conti.

Similarly, Conti's human resources department spends thousands of dollars a month subscribing to numerous job boards, where Conti's HR filters resumes of potential employees. Conti HR specialist Salamandra explained Conti's paid access to an employment platform in a note to task director Stern, stating that they had viewed 25-30% of the relevant resumes on the platform.

Within Conti, there is a dedicated budget allocation department called "Reversers", responsible for finding and exploiting new security vulnerabilities in various hardware, software, and cloud services. On 7 July 2021, Stern ordered department employee Kaktus to start targeting Microsoft's latest operating system, Windows 11, as a priority.

▌Business success is inseparable from partners

Leveraging "third parties" to make the ransom process smoother

Conti's leaked chat logs include multiple internal deliberations regarding how much ransom to demand from different ransomware victim companies, and Conti seems to have sought help from multiple third parties.

Milwaukee-based cyber intelligence firm Hold Security posted a screenshot of a conversation on Twitter in early March, in which a Conti member claimed they could hire a journalist to pressure victim companies into paying ransoms by writing articles.

Chat logs of Conti member Alarm on 30 March 2021 show that third-party journalists could receive a 5% payout.

There are also third-party companies that help victim companies pay virtual currency ransoms, and the Conti team has built good relationships with multiple employees of these third-party "intermediary" companies. One negotiator even had his own nickname in the group—"The Spaniard"—who, according to Conti middle manager Mango, was a Romanian working for a Canadian "intermediary" company.

During ransom negotiations with LeMans Corp, a major powersports distributor, Conti demanded a USD 1 million ransom. A chat on 7 October 2021 showed that this negotiator stated his client could pay a maximum of USD 200,000 and urged Conti to reconsider the ransom amount.

Many businesses purchase cybersecurity insurance to cover potential losses from ransomware attacks. The logs indicate Conti has a mixed attitude towards these victim companies: on one hand, insurers' payout limits restrict their ability to demand huge ransoms; on the other hand, insured victim companies usually resolve negotiations quickly in payout talks.

▌Seize the weakness to remain invincible

"Double Extortion" leaves target companies with no way out

Conti was one of the earliest best practitioners of "double extortion", which charges victim companies a double ransom: one in exchange for the digital keys needed to unlock compromised systems, and another to ensure that any stolen data will be destroyed and not published or sold.

Conti provides victim companies with a dark web link, where the page features a countdown timer. If the victim company fails to negotiate a payment before the timer reaches zero, they will see their internal data automatically published on Conti's blog.

The beauty of double extortion is that even if victims refuse to pay for the key, they may still pay to prevent their data from being leaked.

▌Summary

In the smokeless cyber war, Conti is undoubtedly a constant victor. The leak of Conti's internal chat logs also allows us a glimpse into the success factors of this powerful criminal group. Obviously, Conti fully invests human and material resources into various links such as product polishing, internal security, target analysis, information acquisition, partnerships, and ransom negotiations.

In response to the tactics that ransomware groups may adopt, enterprises should always be prepared. As a ransomware group, Conti validates the effectiveness of its attacks by collecting various security software on the market. So, how do enterprises that use security software as armor validate the effectiveness of their own protection?

As a leading security measurement and validation platform in China, CyWall utilizes real automated attack playbooks to continuously validate the effectiveness of security defenses. CyWall Security Lab boasts an industry-leading security analysis team, providing customers with the latest and most classic APT attack techniques gathered from the internet. It tracks internet hacker groups and vulnerabilities round-the-clock, and uses first-hand intelligence to reconstruct attack techniques at the first opportunity, providing validation methods for uncompromised enterprises.

For enterprises, CyWall is both a source of attack intelligence and a trusted partner. We help enterprises take the first step in knowing themselves and their opponents, enabling them to respond properly, plan ahead, and build another line of defense for network security!

| Reference Source: krebsonsecurity.com