Conti Operates Like A Sophisticated Corporation

After analysing leaked documents, Check Point Research (CPR) can give new details on the inside operations of Conti, the notorious Russian ransomware group. 

Conti is structured like a high-technology company, with clear management, finance and HR functions. Conti recruits not only from underground, but legitimate sources, borrowing CV pools without permission.

Indeed, some employees have no clue that they are part of a cyber criminal operation andCPR has also learned that Conti has business expansion plans for a crypto exchange and a Darknet social network.

CPR has gained new details into the inside-operations of Conti ransomware group which operates a ransomware-as-a-service (RaaS) business model, which allows affiliates to rent access to its infrastructure to launch attacks.

Industry experts have said Conti is based in Russia and may have ties to Russian intelligence. Conti has been blamed for ransomware attacks targeting dozens of businesses and critical infrastructure, like the Irish Health service. The Conti group has several physical offices, including in Russia where the HR team offers monthly bonuses, fines, nominates the employee of the month and undertakes performance reviews. 

On February 27 of this year, a cache of chat logs belonging to the Conti were leaked online at the hands of an alleged insider, who claimed to have objected to the group’s support for the Russian invasion of Ukraine. CPR analysed the leaked files, learning that the ransomware groups operates like a large technology company.

Conti has an HR department, a hiring process, offline office premises, salaries and bonus payments.

Details of Conti’s Inside-Operations

Conti operates like a technology company with a defined hierarchical structure. CPR identified the main people involved with their names: Stern (big boss), Bentley (technical lead), Mango (manager of general questions), Buza (technical manager), Target (manager responsible for coders and their products), Veron aka Mors (focal point of the group’s operations with Emotet).

  • Team leaders who report to upper management.
  • Main groups observed: HR, coders, testers, crypters, sysadmins, reverse engineers, offensive team, OSINT Specialists and Negotiation Staff.

Staff Work In A Physical Office

The Conti group has several physical offices. These are curated by "Target", Stern's partner and effective head of office operations, who is also responsible for the wage fund, office technical equipment, the hiring process and personnel training. 

During 2020, offline offices were mainly used by testers, offensive teams and negotiators; Target mentions 2 offices dedicated to operators who are speaking directly with victim representatives.

  •  In August 2020, an additional office was opened for sysadmins and programmers, under the purview of "Professor, who is responsible for the whole technical process of securing a victim infection.
  • Compensation: monthly bonuses, fines, employee of the month, performance reviews.
  • Members of Conti's negotiating team (including OSINT specialists) are paid by commissions, calculated as a percentage of the paid ransom amount that ranges from 0.5% to 1%. Coders and some of the managers are paid a salary in bitcoin, transferred once or twice a month.
  • Conti employees are not protected by their local labor boards, and so have to endure some practices that typical tech employees are exempt from, such as being fined for underperforming.
  • While fines are mostly used as an established tool in the coder department, they are sporadically employed on in other departments - for example, in IT and DevOps, where one person responsible for depositing money was fined $100 for a missed payment:

Talent Is Recruited From Both Legitimate & Criminal Sources  

For recruiting business staff used by Conti, the HR team use Russian-speaking headhunting services such as headhunter.ru. They have slso used other sites, but reportedly with less success.

Conti corporate policy forbids leaving traces of developer job openings on such websites, a regulation stringently enforced by one of the higher-ups, "Stern" For hiring developers, Conti bypasses the headhunter.ru job system, instead directly accessing the CV pool and contacting candidates by email. You might wonder "why does headhunter.ru offer such a service?", and the answer is, they don't. Conti simply "borrowed" the CV pool without permission, which seems to be standard practice in the cybercrime world.

Some Conti Employees Don’t Know It Is A Cyber Crime Business

In one online job interview, a manager tells a potential hire for the coding team: "everything is anonymous here, the main direction of the company is software for pen-testers". In another example, a group member known by the moniker "Zulas", most likely the person who developed Trickbot's backend in the Erlang programming language. Zulas is passionate about Erlang, eager to show examples of his other work, and even mentions his real name.

When his manager mentions that his "trick" (Trickbot) project was seen by "half of the world", Zulas does not understand the reference, calls the system "lero" and reveals that he has no idea what his software is doing and why the team goes to such lengths to protect member identities. His interlocutor tells him that he is working on a backend for an ad analytics system.

Conti Is Working On Plans For A Crypto Exchange & A Darknet Social Network

One of the ideas discussed was creating a crypto exchange in the group's own ecosystem. Another project is the “darknet social network” (also: "VK for darknet" or "Carbon Black for hackers"), a project inspired by Stern and carried out by Mango, planned to be developed as a commercial project. In July 2021 Conti was already in contact with a designer, who produced a few mockups.

Lotem Finkelstein, Head of Threat Intelligence and Research, at Check Point Research commented, “For the first time, we have a glass door to a group that has been known to be the face of ransomware. Conti acts like a high-tech company. We see hundreds of employees in a hierarchy of managers. We see an HR function, with people responsible for different departments."

Even when employees find out the truth  they decide to stay, revealing that the Conti management team has developed a process for retaining employees. Conti has developed an internal culture to develop profits, as well as fining employees for undesirable behaviour. 

Check Point Research

You Might Also Read: 

Russian Hackers Account For 74% Of Ransomware Proceeds:

 

 

« Operating Technology Security Issues Are Increasing
LAPSUS$ Hackers Claim Responsibility For Large Scale Corporate Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Tresorit

Tresorit

Tresorit helps teams to collaborate securely and easily by protecting their data with end-to-end encryption.

Code Dx

Code Dx

Code Dx is a software application vulnerability correlation and management system.

Sepio Cyber

Sepio Cyber

Sepio is the leading asset risk management platform that operates on asset existence rather than activity.

SynerComm

SynerComm

SynerComm is an IT solution provider specializing in network and security infrastructure, enterprise mobility, remote access, wireless solutions, audit, pentesting and information assurance.

CyberTech Network

CyberTech Network

CyberTECH is a global cybersecurity, Internet of Things (IoT) and Smart City network ecosystem and incubator operator.

CopSonic

CopSonic

Copsonic provide a technology solution based on ultrasonic waves to send secure and encrypted data between two devices in order to achieve authentication.

TechStak

TechStak

TechStak is the easiest way for businesses to find and connect with IT Pros and other technology solution providers in their area.

BrandShield

BrandShield

BrandShield is an anti-counterfeiting, anti-phishing and online brand protection solution.

Winterhawk

Winterhawk

Winterhawk is a specialist and leading global Cyber, ESG, GRC, Risk & Identity consulting practice.

Cybersecurity Center for Secure Evolvable Energy Delivery Systems (SEEDS)

Cybersecurity Center for Secure Evolvable Energy Delivery Systems (SEEDS)

SEEDS conducts research and develops innovative cybersecurity technologies, tools, and methodologies that advance the energy sector’s ability to survive cyber incidents.

Veratad Technologies

Veratad Technologies

Veratad Technologies, LLC is a world class provider of online/real-time Identity Verification, Age Verification, Fraud Prevention and Compliance Solutions.

Moore ClearComm

Moore ClearComm

Moore ClearComm is part of Moore Kingston Smith a leading UK firm of accountants and business advisers. Our services include Data Privacy, Cyber Security, Business Continuity and Information Security.

Cura Technology

Cura Technology

Cura Technology offers a wide array of security solutions meticulously designed to address specific facets of your security requirements.

InQuest

InQuest

InQuest specialize in providing comprehensive network-based security solutions that empower organizations to protect their most critical assets: their people.

Hilltop Technologies

Hilltop Technologies

Hilltop Technologies is a cybersecurity company specialized in managed security services and consulting tailored for all sectors from higher education to publicly traded companies.

Nordic Defender

Nordic Defender

Nordic Defender is the first crowd-powered modern cybersecurity solution provider in the Nordic region.