Conti was the most financially destructive ransomware operation ever documented. Operated by the Russia-based Wizard Spider criminal syndicate, it generated an estimated $180 million in extortion revenue in 2021 alone and accumulated over $2.7 billion across its full operational lifetime (Ryuk and Conti combined). Conti evolved from the TrickBot/Ryuk ecosystem into a full-spectrum Ransomware-as-a-Service empire, run with the organizational structure, HR departments, and professional divisions of a legitimate technology company.

Its implosion in May 2022 was triggered not by law enforcement, but by an internal actor: a Ukrainian security researcher who, incensed by Conti's public declaration of support for Russia's invasion of Ukraine, leaked nearly two years of internal communications. The brand collapsed; the organization did not. Core operators dispersed into a constellation of successor groups including Akira, Black Basta, Royal/BlackSuit, and others that continue operating as of May 2026. Conti is the progenitor of the most consequential criminal diaspora in ransomware history.

The Conti brand is defunct as of May 19, 2022. The core operating network, centered on the individual identified as Vitaly Kovalev (alias "Stern"), remains active through successor entities, with shared laundering infrastructure confirmed by TRM Labs through 2026. [1][4][6]

Conti is a technical evolution of Ryuk ransomware, developed and operated by the same core group that CrowdStrike designates WIZARD SPIDER. CrowdStrike first observed Wizard Spider deploying TrickBot for financial fraud in 2016; the group deployed Ryuk in September 2018 for large-scale big game hunting; and between March and June 2020 the group completed its transition to Conti. The Ryuk-Conti-Wizard Spider lineage is corroborated by independent code analysis from multiple vendors, blockchain forensics from TRM Labs, personnel overlap documented in leaked chats, and infrastructure continuity across all three phases. No credible vendor disputes this lineage. [2][9][22]

Note: Secureworks uses GOLD BLACKBURN for broader TrickBot-related criminal activity. Researchers should verify which designation a given vendor report is applying before drawing cross-vendor comparisons.

Prior to the major 2022 leaks, a disgruntled Conti affiliate leaked the group's operational playbook in August 2021, revealing step-by-step intrusion procedures, tool preferences, and exploitation techniques. This prompted the September 2021 CISA/FBI/NSA joint advisory. The playbook leak was an early warning of internal tensions, particularly between affiliates who felt their treatment or revenue share was inadequate relative to the core team's salaried model. [11][43]

The catalytic event was Conti's February 25, 2022 public statement of support for Russia's invasion of Ukraine:

Within 48 hours, on February 27, 2022, a new Twitter account @ContiLeaks began publishing internal Jabber/XMPP chat logs. According to Brian Krebs and Hold Security founder Alex Holden, the leaker was a Ukrainian security researcher acting on patriotic motivation: "The person releasing this is a Ukrainian and a patriot. He's seeing that Conti is supporting Russia in its invasion of Ukraine, and this is his way to stop them in his mind at least." [10]

The initial leak contained 339 JSON files covering January 29, 2021 to February 27, 2022. Subsequent releases extended coverage to June 22, 2020 to November 16, 2020, ultimately totaling over 170,000 internal chat messages. [2][24]

Krebs on Security published a landmark four-part investigative series based entirely on the leaked logs, constituting the definitive public analysis of Conti's internal operations:

• Part I: Evasion. How Conti detected and responded to law enforcement operations. Internal reaction when the NSA compromised TrickBot in September 2020 ("The one who made this garbage did it very well... It's just some kind of sabotage." - leader "Hof"). Crucially: Russian investigators were aware of the TrickBot/Conti investigation but had assured the group the inquiry would be closed by mid-November 2021. [10]
• Part II: The Office. Day-to-day operations, HR practices, salaries, and organizational structure. Documented pervasive burnout, employees pleading for time off, and leaders demanding 24/7 availability. Annual summer vacations in Crimea. Conti's effort to fund legal defense for arrested TrickBot coder Alla Witte, and the cynical suggestion to leverage that relationship for inside intelligence: "Let's try to find a way to her lawyer right now and offer him to directly sell the data bypassing her." [10][23]
• Part III: Weaponry. Conti's $60,000 legitimate Cobalt Strike license acquisition (via a $30,000 front company payment). Subscriptions to Crunchbase Pro and ZoomInfo for victim research. EDR tools (CrowdStrike Sentinel, Cylance) used to surveil its own administrators. A corrupt recovery firm negotiator nicknamed "The Spaniard" (described as Romanian, working for a large Canadian recovery firm). A journalist on payroll for 5% of payments to pressure non-paying victims. [23]
• Part IV: Cryptocrime. Founder Stern's obsession with building a proprietary peer-to-peer cryptocurrency platform in Rust, modeled on Ethereum/Polkadot. A $100,000 writing contest on Exploit forum to solicit crypto platform ideas. Evidence of involvement in the SQUID pump-and-dump of October 2021. DDoS-based crypto market manipulation. [40]

On March 2, 2022, @ContiLeaks posted fresh logs, demonstrating the infiltrator retained access to infrastructure Conti had not detected. A separate account, @TrickBotLeaks, posted names, photos, and personal information of TrickBot administrators before being suspended within 24 hours.

The full leaked corpus included: 60,000+ internal Jabber messages (first tranche); full Conti Locker v2 source code; administrator panel source code; decryptor tool source code; Bitcoin addresses and wallet data; negotiation logs; infrastructure documentation; phishing templates; HR materials; and screenshots of the live Conti control panel with compromised host telemetry. [1][30][44]

The leaks initially had minimal operational impact. Secureworks (GOLD ULRICK tracking) noted that Conti victim postings actually increased in March 2022, reaching the second-highest monthly total since January 2021. The deeper damage was reputational and jurisdictional: the Conti brand became toxic for affiliates; victims paying Conti risked OFAC sanctions exposure; and the $15 million U.S. government bounty announced in May 2022 made the brand operationally untenable. The organization's response was strategic dissolution rather than destruction. [13][15][41]

In May 2025, a figure operating as GangExposed launched what The Register described as a "high-stakes intelligence war" against Conti's former leadership. GangExposed published detailed dossiers using OSINT, darknet database purchases, and claimed access to a leaked FSB border control database acquired for approximately $250,000. [18][19]

GangExposed's methodology and identity remain unverified. The Kovalev identification is treated as CONFIRMED given independent BKA corroboration. Other identifications are rated CREDIBLE. Technisanct/FalconFeeds assessed the source likely has insider access; other researchers assessed GangExposed could be a former criminal burning former associates. GangExposed stated goals: identify all ~50 key participants, disrupt the Blockchain Life crypto legitimization scheme, and deprive operators of UAE safe haven. [18]

Conti operated a hybrid model unique among ransomware groups. CISA noted in its September 2021 advisory: "It is likely that Conti developers pay the deployers of the ransomware a wage rather than a percentage of the proceeds from a successful attack." The leaked chats confirmed this assessment: Conti maintained a dedicated, salaried workforce of 65-100+ employees paid bimonthly in Bitcoin, with limited external affiliate participation for specific access-broker roles.

Most low-level employees (testers, coders, administrators) earned $1,000–$2,000/month. High-performing coders could earn $5,000–$10,000/month. Senior managers confirmed to Stern on July 18, 2021 that the group employed 62 people; by July 30, payroll had grown to 87. [10][11][23]

The leaked chats documented a corporate-like internal structure with departments, separate budgets, and staff schedules:

• Coders: Programmers writing malicious code and integrating new capabilities
• Testers: Workers testing Conti malware against antivirus products, checking every ~4 hours for new Windows Defender updates
• Administrators: Infrastructure setup, teardown, VPN and server maintenance
• Reverse Engineers ("Reversers"): Disassembling code, studying commercial security products, finding vulnerabilities
• Penetration Testers / Hackers: Front-line operators conducting network intrusions
• OSINT Team: Using Crunchbase Pro, ZoomInfo, SignalHire, Shodan, and Spiderfoot Pro for victim research and financial intelligence
• HR Department: Actively recruiting from Russian job boards (including legitimate employment platforms) and cybercrime forums; reviewing 25–35% of relevant CVs on employment platforms

Conti also maintained what the leaked chats identified as relationships with external access brokers, paying 25–30% of ransom proceeds for specific network access. This was considered suboptimal given its cut into profit margins. [23]

Conti practiced "big game hunting" exclusively, targeting organizations with over $100 million in annual revenue. Ransom demands were typically set as a percentage of the victim's annual revenues. Operators used Crunchbase Pro and ZoomInfo to research victims' insurance coverage, earnings, and investor contacts for leverage. [10][23]

• Cobalt Strike: $60,000 legitimate license acquired via front company. Used for network reconnaissance, lateral movement, and in-memory payload execution.
• Mimikatz / LSASS credential dumping: Privilege escalation; overpass-the-hash Kerberos ticket acquisition documented in DFIR case studies.
• BumbleBee loader: Replaced BazarLoader in later operations (2022).
• SystemBC: Proxy/C2 tunneler for persistent access.
• PsExec + SMB: Lateral movement to distribute Cobalt Strike beacons across domain-joined systems.
• AnyDesk / RDP: Legitimate remote access tools for persistence; RDP sometimes proxied through IcedID process.
• GPO modification: Used to disable Windows Defender across domain; force-updated via Cobalt Strike beacon.
• Rclone / Mega.nz / dedicated VPS: Data exfiltration tooling; Rclone to cloud storage and purpose-built VPS instances for high-volume exfiltration.

The Conti playbook leak revealed a highly professional approach to dwell time: operators spent weeks inside networks before deploying ransomware. The Ireland HSE attack illustrates this: initial access on March 18, 2021, via a malicious Excel attachment; ransomware detonation not until May 14, 2021, eight weeks later, during which attackers moved across 180 systems and multiple domains. [37]

• Algorithm: AES-256 (initial); ChaCha stream cipher adopted August 2020 for selective, high-speed file encryption.
• Throughput: Multi-threaded engine using up to 32 simultaneous CPU threads. ZDNet documented Conti as using "32 simultaneous CPU threads for blazing-fast encryption" (July 2020).
• Key management: Asymmetric RSA wrapper around symmetric session key; public key embedded in binary, private key held by attackers.
• Variants: Encrypted file extension .ODMUA in some documented variants; ransom note named CONTI_README.txt.
• Decryptor: Bitdefender released a free Conti decryption tool after source code leak; applicability limited to variants encrypted before certain key rotation events.

Conti's consistent avoidance of CIS-region targets across more than 1,000 confirmed attacks, with no known exceptions, is an operational signature consistent with an implicit non-prosecution understanding with Russian authorities. Binary analysis indicates Conti checks for Russian keyboard layout installation as a kill switch, consistent with the standard CIS-exclusion pattern used by other Russia-based groups. The behavioral exclusion is documented across all major sector-targeting data; the specific binary implementation details are less publicly documented than peers such as REvil. [9]

Conti developed a dedicated Linux/ESXi variant targeting VMware virtual machine infrastructure, consistent with the group's enterprise-focused targeting. This variant was documented by SentinelOne and became a direct template for successor groups. Akira inherited the Conti ESXi playbook and extended it with additional VMware-targeting capabilities documented in joint FBI/CISA advisories. [39]

Conti demanded payment exclusively in Bitcoin (BTC). Chainalysis identified Conti generating at least $180 million in 2021, the highest of any ransomware group that year. Total lifetime revenue across Ryuk/Conti operations is assessed at approximately $2.7 billion. The UK NCA and Chainalysis jointly assessed Conti and TrickBot attempted to extort more than $800 million from victims including hospitals, schools, local authorities, and businesses. [5][17][40]

• Payroll: $1,000–$2,000/month for most employees; $5,000–$10,000 for senior coders; distributed in Bitcoin bimonthly
• Ransom receipts: Single highest documented payment: $25M; Ireland HSE demanded $20M (not paid)
• Costa Rica: $20M demand; government refused; no payment made

Krebs on Security's deep analysis of leaked chats (Part IV: Cryptocrime) documented extensive laundering and investment schemes directed personally by founder "Stern" (Kovalev): [40]

• Proprietary crypto platform: Kovalev was developing a peer-to-peer cryptocurrency platform in Rust, modeled on Ethereum/Polkadot with integrated NFT, DeFi, and DEX functionality, intended as a vehicle to legitimize illicit proceeds.
• $100,000 crypto article contest: Sponsored on the Russian-language Exploit cybercrime forum to solicit intellectual property for the platform while simultaneously serving as criminal recruitment.
• SQUID pump-and-dump: Evidence in chat logs suggests Conti involvement in the October–November 2021 SQUID token scam, which appreciated from $0.01 to $2,856 before the developers extracted approximately $3.38 million.
• DDoS-driven crypto manipulation: An internal scheme involving DDoSing small cryptocurrency mining pools, then posing as distressed users in Discord to drive prices down before purchasing.
• Blockchain Life Forum: GangExposed's 2025 investigation revealed Kovalev and associate Khitrov organized the "Blockchain Life" forum as a legitimization vehicle for illicitly obtained cryptocurrency earnings.

TRM Labs corroborated Conti-Ryuk blockchain ties through salary wallet analysis and on-chain transaction mapping, confirming shared financial infrastructure across both phases of Wizard Spider ransomware operations. In a separate 2023 analysis, TRM documented Conti's re-emergence as three successor groups. TRM Labs' 2026 reporting on Akira specifically confirmed that Conti's successor ecosystem (including Akira) continued sharing laundering infrastructure, providing blockchain continuity evidence linking the diaspora to the original Conti network. [22][4]

• Over 1,000 attacks confirmed globally (FBI/CISA advisory, updated)
• DOJ 2023 indictment figures: more than 900 victims in approximately 47 U.S. states, D.C., Puerto Rico, and approximately 31 foreign countries
• $180M revenue in 2021 alone (Chainalysis); ~$2.7B total (Ryuk/Conti lifetime)
• Over $150M in ransom payments per State Department figures at time of $15M reward announcement

Conti deliberately focused on sectors with low tolerance for downtime and high pressure to pay. Healthcare was the most systematically targeted sector; the FBI documented at least 16 Conti attacks on U.S. healthcare and first-responder networks by May 2021 alone.

Primary targets concentrated in North America (~75% U.S.-based per early FBI figures). Significant European targeting documented (UK: 149 known victims, £27 million extracted per NCA). Consistent behavioral exclusion of CIS-region targets across all documented attacks. [17][28]

On September 7, 2023, the DOJ unsealed three federal indictments across three jurisdictions, charging nine Russian nationals:

All named defendants remain at large in Russia as of May 2026. [16]

The U.S. OFAC and UK FCDO simultaneously sanctioned 11 Russian nationals connected to Conti and TrickBot: Andrey Zhuykov, Maksim Galochkin, Maksim Rudenskiy, Mikhail Tsarev, Dmitry Putilin, Maksim Khaliullin, Sergey Loguntsov, Vadym Valiakhmetov, Artem Kurov, Mikhail Chernov, and Alexander Mozhaev. Sanctions prohibit financial transactions and enable asset seizure by U.S. and UK governments. [17]

• May 2021: FBI alert specifically warning healthcare sector; 16 attacks on healthcare/first responder networks documented
• September 2021: Joint CISA/FBI/NSA advisory documenting 400+ attacks, TTPs, and mitigations
• May 2022: State Department Rewards for Justice: up to $10M for Conti leadership identification/location; up to $5M for arrest/conviction
• August 2022: Rewards for Justice expanded: five specific operators named; photograph of "Target" released publicly
• May 2025: BKA Germany names Vitaly Kovalev as Conti/TrickBot founder; Interpol Red Notice issued

The leaked Jabber logs contain the most direct documentation of Conti's communication with Russian law enforcement available in open-source reporting. In October 2021, Conti member "Kagas" wrote to Stern:

A separate Conti member immediately reported that the group's contacts had assured it the Russian-side investigation would go nowhere and would be closed by mid-November 2021. This same period saw Russian investigators appearing more interested in pursuing REvil members than Conti, culminating in the January 2022 FSB arrests of REvil, which many analysts assessed as a political gesture timed to the Ukraine buildup. The leaked chats also reference Liteyny Avenue in Saint Petersburg, home to FSB offices, in a context suggesting external contact with a helpful government-adjacent source. [10][22]

The available evidence supports a moderate-to-high confidence assessment of implicit state toleration. Conti received advance warning from Russian investigators, operated openly in Russia without prosecution, and consistently avoided CIS targets across 1,000+ documented attacks. The leaked chats document direct back-channel communication between Conti leadership and Russian law enforcement. A formal, active intelligence-sharing or tasking relationship cannot be confirmed from public evidence. The operational distinction is likely: Conti's ransomware attacks generated hard currency and geopolitical leverage that served Russian state interests without requiring formal direction. The protected criminal enterprise model eliminates the state's deniability costs while preserving its operational benefits.

The reference to Liteyny Avenue (FSB headquarters street) in leaked communications, combined with the demonstrated advance warning of law enforcement inquiries, is consistent with an active FSB liaison relationship rather than passive tolerance. This remains analyst inference; the chats establish contact but not formal tasking. [10][48]

The Conti collapse was an own-goal triggered by geopolitics. The group's public declaration of support for Russia's invasion of Ukraine was catastrophically ill-considered:

• It exposed the group's Russian identity and state alignment to affiliates who had operational security reasons to maintain deniability
• It triggered the Ukrainian insider who had penetrated Conti's infrastructure to act, releasing the most comprehensive criminal organization leak in cybercrime history
• It made the Conti brand a liability for victims: paying Conti created sanctions violation exposure under OFAC
• It caused direct internal fracture along ethnic lines, with Ukrainian members becoming adversaries

AdvIntel's Boguslavskiy and Kremez concluded: "The Conti brand, not the organization itself, is shutting down." The Costa Rica attack served simultaneously as a final high-profile operation, cover for migrating members and infrastructure, and a capability demonstration to affiliates considering defection to competing groups. [15][14]

The February 2025 Black Basta internal chat leak followed the same pattern as the original Conti leak: an insider/disgruntled member published internal communications, directly contributing to the group's dissolution. The Conti diaspora appears condemned to repeat the cycle. The organizational model of large, salaried, multi-ethnic workforces creates structural insider threat exposure that pure-affiliate models do not share. Each generation of Conti-lineage groups inherits both the operational playbook and this structural vulnerability.

• "Target" identity: Despite a $10M U.S. bounty and GangExposed's stated intent to identify him, Target's real name has not been publicly confirmed
• Full financial scope: Total cryptocurrency holdings and current wallet infrastructure of the Conti diaspora are partially mapped but not fully documented
• Formal state intelligence relationship: The exact nature of FSB involvement or passive tolerance remains an open question; leaked chats establish back-channel contact but not formal tasking
• GangExposed identity and motivation: Source's own identity, access method, and motivations remain unconfirmed; possibility that GangExposed is state-adjacent cannot be ruled out
• Akira/Royal operational leadership: Actor overlap assessed with high confidence; full attribution of current operational leadership to specific former Conti individuals is incomplete in public reporting