Overview of Darknet Diaries Episode 180: Conti
This episode tells the rise-and-fall story of Conti, one of the most successful and feared ransomware gangs ever documented. Jack Rhysider traces how a Russian-speaking cybercrime ecosystem evolved from earlier groups like Dyre and TrickBot into Conti, how it operated like a real corporation, and how it was ultimately undone by internal leaks, geopolitical fallout from the Ukraine war, and law-enforcement pressure. The episode centers on the people behind the gang, the devastating attacks they carried out, and the extraordinary leak that exposed thousands of their private messages to the world.
The Origins of Conti
Conti didn’t appear out of nowhere. It grew out of earlier Russian cybercriminal groups:
- Dyre and then TrickBot were the predecessors.
- A key organizer was a Russian crime boss known as Bentley, later better known as Stern.
- Bentley was unusually entrepreneurial, even setting up a film production company called the 25th Floor Film Company to launder cybercrime money.
The strange film-company angle
The gang even tried to use the film company to make a movie about hackers called Botnet. That plan backfired spectacularly when the company was raided by Russian authorities in 2015, which helped push the group into a new phase. Out of that collapse, Conti ransomware emerged as the dominant brand.
How Conti Operated
Conti was not a loose collection of criminals; it functioned more like a startup or corporation:
- It recruited people through Russian job sites.
- It used nicknames, remote work, and compartmentalized roles.
- Members handled coding, negotiations, data theft, infrastructure, and affiliate management.
- It offered ransomware as a service, where affiliates would breach a target and Conti would handle negotiation and payment collection, taking a cut.
Key people
- Stern / Vitaly Kovalev: the leader, later identified by investigators as a Russian national.
- Max / Alavita: a Latvian programmer who unknowingly joined the gang and later became part of Conti’s internal operations.
- Affiliates: outside operators who used Conti’s ransomware to infect victims and split profits.
Max’s Path Into the Gang
One of the most human parts of the story is Max, a coder from Latvia living in South America who thought she was taking a normal programming job.
What she encountered instead:
- remote coworkers using fake names,
- no video calls,
- vague descriptions of the work,
- and eventually a website template for a ransomware note.
At first, she rationalized the job as just coding, but she gradually realized she was helping a ransomware operation. Her story shows how Conti recruited ordinary technical workers into a criminal enterprise while keeping the true nature of the work obscured.
Her downfall
Max became a target of investigators because of weak operational security:
- she reportedly hosted code on her own website,
- had identifiable online traces,
- and was ultimately arrested by U.S. authorities in Miami after being linked to Conti/TrickBot activity.
Major Attacks and Criminal Tactics
Conti became infamous for large-scale, high-pressure attacks that combined:
- encryption of files
- data theft
- extortion threats to leak stolen data
This “double extortion” model gave them leverage even if victims had backups.
Ireland’s health service attack
One of the episode’s most shocking examples was the attack on Ireland’s hospital network during the COVID pandemic:
- The intrusion began with a phishing email and malicious Excel attachment.
- The attack spread across tens of thousands of machines and dozens of hospitals.
- Clinicians had to revert to paper records.
- Cancer treatment, testing, maternity care, and other services were disrupted.
- Conti demanded $20 million and claimed to have stolen hundreds of gigabytes of sensitive data.
Ireland refused to pay, but the health system still suffered weeks of chaos before Conti unexpectedly provided a decryption key. The reason remains unclear.
Graff jewelry company breach
Conti also hit the luxury jeweler Graff, stealing customer data tied to wealthy and famous clients.
This attack showed how Conti used stolen information as pressure:
- encrypt systems,
- steal sensitive data,
- threaten publication,
- and force payment.
The episode notes that Conti’s leaked sample data accidentally exposed information tied to Saudi royals, which appears to have spooked the gang badly enough that they issued a rare apology and retracted the material.
Conti’s Internal Leak and Collapse
A major turning point came when an Ukrainian IT specialist infiltrated the gang’s communications and leaked them through the Twitter account @ContiLeaks after Russia invaded Ukraine.
What the leak exposed
The leaks included:
- tens of thousands of internal chat messages,
- operational planning,
- member identities and nicknames,
- organizational structure,
- payment details,
- and internal arguments.
It was a rare, intimate look at a ransomware gang from the inside.
Why the leak mattered
The messages revealed that Conti:
- operated like a structured company,
- had departments and budgeting,
- discussed targets in businesslike terms,
- and contained internal tension over attacks on hospitals and other sensitive targets.
The leak also made it easier for researchers and law enforcement to identify members and affiliates. It fractured the organization and pushed its people into other groups.
Conti’s Politics, War, and Final Unraveling
The Russia–Ukraine war accelerated Conti’s collapse.
- Many Conti members were Ukrainian.
- The gang publicly declared support for Russia, which caused internal outrage.
- Members argued bitterly in chat logs.
- The war split the group emotionally and operationally.
After the leaks and wartime fracture, Conti’s leadership structure broke down:
- Stern largely vanished from daily operations.
- The group became disorganized.
- Affiliates drifted into other ransomware gangs.
- Conti’s brand effectively died after its final major campaign.
The Costa Rica Attack: Conti’s Last Big Move
Conti’s final major headline-making operation was a huge attack on Costa Rica’s government:
- Treasury and customs systems were disrupted.
- Salaries, pensions, and government services were affected.
- Multiple ministries and agencies were hit.
- The country declared a national emergency.
This attack appeared to be either carried out by Conti, by former Conti affiliates, or by actors using Conti infrastructure and reputation. In any case, it was widely seen as Conti’s last major operation.
What Happened to the Leaders
The episode closes by noting that while many members remain unidentified, Stern was eventually identified as Vitaly Kovalev:
- sanctioned by the U.S., U.K., and EU
- tied to TrickBot and Conti
- allegedly linked to hundreds of millions of dollars in ransomware proceeds
The bigger unresolved question is what happened to the rest of the network and where all the money ended up. The episode suggests that laundering routes likely ran through crypto services and Middle East-based hubs, especially Dubai.
Key Takeaways
1. Cybercrime can function like a corporation
Conti had structure, roles, management, budgets, and affiliates—more like a business than a street gang.
2. Double extortion changed ransomware
Stealing data before encryption made victims far more vulnerable, even if they had backups.
3. Leaks can be more damaging than arrests
The ContiLeaks dump exposed the gang’s internal workings in a way law enforcement couldn’t.
4. Geopolitics can destabilize criminal networks
Russia’s invasion of Ukraine tore through Conti’s membership and unity.
5. Hospitals are especially vulnerable targets
The Ireland attack is a major example of how ransomware can endanger lives, not just data.
Notable Insight
A recurring theme in the episode is that the most dangerous hackers are often the ones who look the most ordinary. Conti members were not movie-style villains—they were programmers, managers, negotiators, and recruiters embedded in a criminal system that ran on discipline, money, and fear.
Further Listening Mentioned
- The Conti Files by Jeff White / BBC-related reporting
- Jack Rhysider’s new podcast Low