One of the world’s most famous ransomware (opens in new tab) threat actors, Conti, is breaking up - however there is very little reason to celebrate.
As reported by cybersecurity researchers from Advanced Intel, the group’s internal infrastructure, including Tor admin panes used for content publishing and negotiations, has been shut down. What’s more, BleepingComputer found that other internal services (such as rocket chat servers) are being decommissioned, as well.
But this doesn’t mean the people behind the name will drop the world of cybercrime altogether. Instead, they’ll be partnering with other, smaller ransomware groups, creating a whole swathe of ransomware groups, all reporting to a central figure.
(opens in new tab)At "war" with Costa Rica
Not only will they continue attacking businesses everywhere, but being broken up into semi-autonomous entities will make them more agile, and consequently - a bigger threat.
Among the groups Conti’s members joined forces with, are HelloKitty, AvosLocker, Hive, BlackCat, BlackByte, and others, Advanced Intel claims. What’s more, new autonomous groups were built, whose key goals will be data exfiltration. Some of them are Karakurt, BlackByte, and the Bazarcall collective.
Conti is one of the world’s most well-known cybercrime (opens in new tab) groups. It’s one of the first groups to publicly express its support for the Russian invasion of Ukraine, which didn’t sit well with many of its partners and peers. Other ransomware groups and threat actors ended up publishing its source code and internal chats online.
> Microsoft wants to try and kill off ransomware for good (opens in new tab)
> Conti ransomware group has internal chats leaked after siding with Russia (opens in new tab)
> Costa Rica declares national emergency after Conti ransomware attacks (opens in new tab)
At the moment, Conti is engaged in a full-blown cyber-war with the government of Costa Rica, hitting 27 government institutions including municipalities, utilities, and the Ministry of Finance, in a recent attack.
However, researchers believe that the attack was a “facade of live operation” while it pivots towards smaller entities.
“The only goal Conti had wanted to meet with this final attack was to use the platform as a tool of publicity, performing their own death and subsequent rebirth in the most plausible way it could have been conceived," Advanced Intel’s report states.
- Protect your computers from Conti ransomware with the best antivirus solutions right now (opens in new tab)
Via: BleepingComputer (opens in new tab)
