2 March 2022

Conti ransomware source code leaks online


Conti ransomware source code leaks online

Twitter user known as ContiLeaks has released more data related to Conti ransomware gang, including the source code for the group's administrative panel, the BazarBackdoor API, and screenshots of storage servers.

The researcher began leaking data after Conti sided with the Russian government on the invasion of Ukraine. Earlier this week, ContiLeaks shared thousands of internal messages belonging to members of the Conti ransomware group, including 393 JSON files containing a total of 60,694 messages since January 21, 2021, through February 27, 2022. These messages contain various information about the gang's activities, including previously unreported victims, messages confirming the shut down of the TrickBot botnet earlier this month, private data leak URLs, bitcoin addresses, and discussions about their operations.

The new leak also includes additional 148 JSON files containing 107,000 internal messages since June 2020.

While the release of the Conti ransomware source code can be considered a good thing, as it provides more insight into the ransomware operation, it can also be used by other malicious actors to launch their own operations.

Cybersecurity Help’s statement on the critical situation in Ukraine

On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war!

Back to the list

Latest Posts

Threat actors increasingly abusing Microsoft Graph

Threat actors increasingly abusing Microsoft Graph

Graph API is often used for discreet communications to cloud-based C&C servers.
6 May 2024
Marriott admits its systems were not encrypted before 2018 data breach

Marriott admits its systems were not encrypted before 2018 data breach

Marriott has acknowledged that it used SHA-1 algorithm, which does not qualify as encryption.
6 May 2024
Russian military spies APT28 exploited Outlook 0day to attack Czechia and Germany

Russian military spies APT28 exploited Outlook 0day to attack Czechia and Germany

The attacks targeted entities "related to Russia's war of aggression against Ukraine."
6 May 2024