Conti-versal opinions. [Research Saturday]

Summary

Podcast Summary: CyberWire Daily — Conti-versal Opinions [Research Saturday]

Date: July 11, 2026
Host: Dave Bittner (N2K Networks)
Guest: Jeff White (BBC journalist and host of the “Cyberhack” podcast)

---

Episode Overview

This episode delves into the inner workings of the notorious Conti ransomware gang, guided by Jeff White’s extensive research based on a massive leak of Conti’s internal communications. The conversation explores the group’s organizational structure, its culture, ethical debates around targeting healthcare, operational mishaps, and what ultimately led to their downfall. The episode is rich with insight from thousands of leaked messages, exposing the realities of global cybercrime beyond headlines.

---

Key Discussion Points and Insights

1. The Significance of the Conti Leaks

• Conti’s Status: Once the world’s preeminent ransomware group.
• Nature of the Leaks: Over 350,000 internal messages—villains talking in real-time, unaware their words would become public.
  • “It really feels like you’re inside the room with the guys. It’s incredible. It really is incredible.”
    — Jeff White [03:32]
• Challenge in Analysis: Language barriers (Cyrillic, Russian slang), slang (“cue balls” for Bitcoin, “grandmas” for cash), and staggering volume render AI solutions unreliable.
  • “Translation engines do not do well with Cyrillic... just using an AI engine just wouldn’t work.”
    — Jeff White [04:10]
• Investigative Process: Jeff has manually read through 47,000 messages, gaining deep familiarity with Conti’s members.

2. Inside the Organization: Culture and Structure

• Internal Dynamics: Mundane business concerns dominate—staffing, recruitment, management issues, gossip, and even “bitching.”
  • “Hackers can be quite bitchy people.”
    — Jeff White [06:16]
• Business Mentality: Criminals reframed extortion as “business,” rationalizing their work and scaling operations.
• Recruitment Struggles: High attrition due to the tainted nature of the work; many prospects drop out once they realize it’s criminal.
  • “Just obsessed with getting bums on seats.”
    — Jeff White [07:14]

3. Hierarchy and Franchising

• Central Leadership:
  • Stern (boss and owner of the money; terse and shadowy)
  • Mango (akin to an office manager)
  • Professor (lead coder)
• Affiliate Model: Conti franchised their ransomware—outsourcing distribution and attacks, resulting in loss of brand control, similar to McDonald’s franchise issues.
  • “Conti was a bit the same, but they weren’t able to do it to the extent that McDonald’s [does], ’cause juggling these people... became a huge headache.”
    — Jeff White [09:06]

4. Who Was Stern?

• Identity: Leaked chats and law enforcement investigations identified Stern as Vitaly Kovalev, a Russian in his 30s with a long history in cybercrime (previously involved with the Zeus group under the nickname “Bentley”).
  • “He looks very friendly and cheery, but actually he’s alleged to be behind this giant crime ring.”
    — Jeff White [11:29]
• Timeline: His criminal career spanned over a decade, including major roles in global cybercrime.

5. Power Dynamics: Affiliates vs. Core Developers

• Ransomware Coders vs. Spreaders: Coders write the malware, but rely on affiliates for distribution (phishing, social engineering).
• Payout Splits: Sometimes affiliates received up to 80-90% of ransoms, underlining a competitive “market” for cybercriminal labor.
  • “That implies to me that the power’s on the affiliate side... It’s a competitive marketplace.”
    — Jeff White [13:40]

Notable Segment

On Internal Debates Over Targeting Healthcare
[16:04]

• Diverse opinions exist within gangs: some actively targeted healthcare during crisis periods for higher payouts; others refused, possibly due to ethical or pragmatic considerations (e.g., increased law enforcement attention).
  • “We see all the way at the other end... operators saying, ‘We don’t hit healthcare.’”
    — Jeff White [16:40]
  • “Even if not [fatalities], we’ve seen very, very sensitive operations being rescheduled... so it’s not just the deaths, it’s the suffering of people and the psychological suffering.”
    — Jeff White [16:23]

On Graff/ Saudi Royal Family Incident
[17:58]

• Conti’s double-extortion methods backfired when they inadvertently leaked Saudi royal family data, causing panic and prompting a farcical “apology”—but the data was never really deleted.
  • “There are people in the world that you want to upset and people that you don’t... the Conti Gang really got scared about this.”
    — Jeff White [18:48]
  • “When they tell you they’ve deleted your data, these ransomware gangs... are almost certainly lying.”
    — Jeff White [19:56]

The Arrest of Alla Vita — Inside the Panic
[20:18]

• When affiliate Alla Vita was arrested, the group scrambled to contain the fallout, worried she’d reveal operational secrets.
  • “How do you pay the lawyer without your money being seized... It was going to cost us hundreds of thousands.”
    — Jeff White [21:55]
• Alla Vita ultimately served prison time and returned to Latvia; her profile echoed a recurrent theme—“cutouts” who knowingly or unwittingly end up in criminal tech roles.

6. Stereotypes and Realities: What Are Cybercriminals Actually Like?

[23:07]

• The daily routine is astonishingly mundane—staffing, IT issues, HR headaches, strategy—like any corporate office.
  • “Only when you’ve read 47,000 messages, quite a lot of which are very boring, that you realize quite how mundane and businesslike this operation was.”
    — Jeff White [23:45]
• The Achilles’ heel remains: unlike legit businesses, trust is scarce and loyalty is fleeting.

7. The Downfall: Conti’s Final Act

[25:04]

• Conti’s chat leaks coincided with Russia’s invasion of Ukraine; one last brazen attack on Costa Rica’s government followed, but the group quickly fragmented.
• Multiple theories: farewell “swan song,” nation-state merger, rogue affiliates, or an attempt to signal ongoing viability—but Conti, as a brand, was over.
  • “Was it a rogue affiliate... Had Conti at that point merged into some kind of nation-state activity? We don’t know.”
    — Jeff White [25:28]

8. The Human Cost: The Irish Health Service Attack

[26:41]

• Jeff’s most poignant takeaway: an Irish cancer patient’s therapy delayed and nearly compromised by Conti’s attack, personalizing the real-world damage of cybercrime.
  • “That’s how close to the wire you get... real people really suffer.”
    — Jeff White [28:00]

---

Memorable Quotes & Timestamps

• “It’s only when you’ve read... 47,000 of these messages... that you really feel like you know them, you understand them, you hear their voices.”
  — Jeff White [05:21]

• “I have a theory... being a business was also a way, I think psychologically, to just keep doing this quite horrible task day in, day out.”
  — Jeff White [06:49]

• “Conti declared their support for Vladimir Putin’s special operation... someone in the gang did not like that. So that’s how these chats get leaked.”
  — Jeff White [10:17]

• “They thought about the same stuff every organization thinks about. Recruitment, retention, strategy, reputation.”
  — Jeff White [23:43]

• “Only when you’ve read 47,000 messages... do you realize quite how mundane and businesslike this operation was.”
  — Jeff White [23:45]

• “We don’t know why [Costa Rica] happened, because at that point, the Conti gang was... disintegrated largely.”
  — Jeff White [25:12]

---

Key Timestamps

• [02:11] — Why the Conti leaks are an extraordinary investigative resource
• [03:48] — Challenges of analyzing 350,000+ messages and the limitations of AI
• [06:14] — Conti’s business logic and recruitment hurdles
• [09:45] — Identity of "Stern" and law enforcement perspective
• [12:57] — Power dynamics between coders and affiliates, financial splits
• [16:04] — Internal debates and ethics around healthcare targeting
• [17:58] — The Saudi royal family data leak: a criminal blunder
• [20:18] — Alla Vita’s arrest and Conti’s scramble to respond
• [23:26] — Breaking preconceptions about cybercriminals’ day-to-day life
• [25:04] — The last days of Conti and attack on Costa Rica
• [26:41] — Human stories from Conti’s healthcare attack in Ireland

---

Final Thoughts

Through an unprecedented window into the Conti gang’s private world, Jeff White brings to light not only the mechanics and psychology of major ransomware operations but also the profound human cost often lost behind headline numbers. The leaked chats reveal criminals rationalizing, bickering, and justifying their work, while victims struggle through life-altering consequences. The story of Conti is not only about business, technology, and crime—but about people, their choices, and their vulnerabilities.

For listeners who want to understand the real face of cybercrime and the kinds of people who drive it, this episode is essential and sobering.

Transcript

[Dave Bittner]

You're listening to the Cyberwire Network powered by N2K.

[Jeff White]

If you are heading to Black Hat USA this year, make plans to visit the Spectre Ops Kennel Club. As the creators of Bloodhound, the Spectre Ops team will host talks, workshops and hands on sessions aimed at helping you understand AI accelerated attack paths to the latest identity tradecraft and how to build your own open graph collector. Visit SpectreOps IE to pre register and learn more. While you're at the Spectrops Kennel club, visit the N2K CyberWire podcast studio where we'll be capturing expert perspectives and conversations from across Black Hat. We'll see you there. AI is making phishing attacks faster, more convincing and harder for people to spot, and traditional security awareness and phishing training weren't designed for this level of attack. HOX Hunt helps security teams prepare employees for the attacks they face every day with personalized phishing training that adapts to each employee and reduces risky behavior over time for IT and security leaders looking to strengthen their human layer of defense without adding more manual work. Visit hoxhunt.com cyberwire to learn more. That's H O-X H U N T.com cyberwire. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.

[Dave Bittner]

Well, firstly, as a lot of your listeners will know, Conti were at one stage the preeminent ransomware group in the world. But the thing that really appealed about Conti was that for reasons I'm sure we'll go into in this podcast, a huge trove of their insider internal secret communications was leaked onto the Internet. Just publicly leaked. We're talking something in the order in the end of 350,000 messages.

[Jeff White]

That's Jeff White, BBC journalist and host of Cyberhack. Today we're taking a deep dive into his research into the Conti ransomware gang.

[Dave Bittner]

And the reason that's so of interest to someone like me, sort of an investigative journalist, is that to tell a story you really need three things. You need a victim and a villain and a hero. That's the classic thing. Now, heroes often want to tell their story when they've had a good experience. Victims, increasingly we can convince them to talk and to talk about what's happened to them. But villains? Actually hearing from villains is quite hard. You get sometimes people who've used to Be a villain, but have now gone straight. Who can talk about it? Or someone, maybe who's in prison, who got caught? What's amazing about these leaks from inside Conti is it was the villains talking at the time they were doing the crimes, when they had no idea these communications were gonna be public. In the end, you really get to feel like you're inside the room with the guys. It's incredible. It really is incredible.

[Jeff White]

How do you go at such a huge trove of information here? How do you organize it and make it digestible?

[Dave Bittner]

The simple answer is you don't and you can't. And that's one of the frustrations of this. I mean, look, I know what your listeners will be thinking, and you're maybe thinking it yourself, Dave, as well. Just use AI, you know, use AI. It'll sort it all out. There's a couple of problems with that. I mean, firstly, it's a vast trove of information. I mean, 300,000 messages. I don't know how much it would cost to put that all into an AI engine, but I don't have that money. Anyway, the other thing is that this is all because the Conti gang were largely based, or at least the leadership's largely based. We believe in Russia, these chats were all in Cyrillic. Now, translation engines do not do well with Cyrillic. So one of the examples is, you know, in the leaks, they keep talking about the cue ball, you know, like a sort of snooker or pool or, you know, billiards ball. And I couldn't understand why they kept talking about cue balls all the time. And it turns out it's a mistranslation. In Russian, bitcoin is bitcoin, but the N in Cyrillic looks like a V. So when the translations engines translate it, they translate it as Bitkov, which is cue ball. So immediately you start to run into problems. And the other thing, of course, is these guys are using hacker slang, criminal slang. So again, they keep talking about the grandmas in the conversations. Who's got the grandmas? And I couldn't understand why they're all obsessed with their grandmas. But then it turns out that in Russian, obviously, grandma's babushka. And there's some word, I forget the exact word, but something like babiya or something, which means cash or money. So whenever they talk about who's got the grandma's, they're talking about who's got the money. So immediately, just using an AI engine just wouldn't work. And the other thing is, for me, as an investigative journalist, I want to get up close and personal with these guys. I really want to understand who they are. And it's only once you've read and I've read, I think I'm up to 47,000 of these messages so far. It's only when you're at that stage that you really feel like you know them, you understand them, you hear their voices and who they are.

[Jeff White]

It's almost like you have to contend with Cockney rhyming slang.

[Dave Bittner]

It's very similar. I watched a film yesterday about a very famous jewelry heist in the uk, the Hatton Garden jewelry heist, which was perpetrated by some very old school, old school crooks who talked in Cockney rhyming slang. And yeah, you're exactly right. All. It's not just all crime gangs. Lots of organizations have their own internal language, but it's very similar. Yeah.

[Jeff White]

Well, let's talk about the organization itself. As you dug into these chats, what picture emerged of how Conti actually operates day to day?

[Dave Bittner]

Again, it's fascinating reading through these chats because yes, there is gossip about what they're going to spend their money on and there's a lot of bitching goes on, a lot of backbiting goes on in the Conte organization. Hackers are quite. Can be quite bitchy people. But really what they're doing fundamentally day to day is trying to work out how they can expand and scale and develop their business. I have a theory about Conti, which is that and actually a lot of ransomware gangs, these are not stupid people. I mean, ransomware is not an easy thing to do by any stretch of the imagination. To wake up as an intelligent person every day and extort people is hard because you have to really get close to your victim. You've got to really put some pressure on them. I don't think intelligent people are easily able to do that. So I think what happened with the Conti gang is they ended up certainly some in the team reframing what they did as business. It's like, okay, I have a client list. I've got to hit my client list today. I've got to negotiate with this person. I've got to meet that person. I'm juggling this client. It just being a business was a way to scale it and make money. But being a business was also a way, I think psychologically to just keep doing this quite horrible task day in, day out. And so that's what they're obsessed with. And it was mundane stuff. I mean, I'll be honest with you, dav, main things that they talk about obsessively day in, day out is recruitment. They cannot get enough people through the door. They can't. And there's some solid logistical reasons for that. You know, they can't advertise what they're doing openly. They can't say, do you want to join a ransomware gang? You know, put that on monster.com or, you know, indeed. Or whatever. So they had to be quite cagey. And immediately, as soon as they reveal that this is actually something quite dodgy, half the candidates just disappear. They don't want to work for crime gangs, so they have to recruit loads and loads of people initially, because at the end of the process, they're only going to end up with a fraction of those people really being able to work and work properly. So they're just obsessed with getting bums on seats. It's really interesting. And how much they pay these people, what they tell them, whether staff management issues occupy a lot of time for compti.

[Jeff White]

What does the power structure look like internally? How are they organized?

[Dave Bittner]

That's a really good question. And there is, and we explore this in the podcast, definitely, a central power structure. So the man who's behind all of this goes by the hacker nicknamed Stern. Stern was the boss. Stern had the money. We can go into who he is alleged to be and why he's got money in a bit, but he's also got some junior people. There's a guy called Mango who's kind of like the office manager. There's a guy called professor, who, as the name suggests, he does a lot of the coding. He regards himself as a sort of champion coder. And so there's all those people internally. But what Conti struggled with, and one of the things that ended up helping Conti's demise, if you like, was that it was a numbers game. The more victims they hit with ransomware, the more money they made. So what they turned to was the affiliate network, effectively franchising out the operation, making their malware available for other people to use. At that point, that central team of people loses control of the brand in the same way that McDonald's has to keep a careful eye on what all its managers are doing so that the McDonald's brand is still reputable. All those McDonald's restaurants, all run by individual managers, their franchises. Conti was a bit the same, but they weren't able to do it to the extent that McDonald's were able to do it, because juggling these people and controlling these affiliates became A huge headache. So you've got a tight central structure, a tight product, but in trying to scale it, they ran into the problems of franchise operation. Runs into.

[Jeff White]

Well, let's talk about the boss. Who do you suppose was behind this?

[Dave Bittner]

As I say, there's a hacker nickname called Stern. We see from the leaked chats from within Conti that we've been through, we see Stern as being the boss. He's the guy with the money, always a shadowy figure. Doesn't say a lot in the chat. Is very terse, very, I'd say, very Russian in his communications. Doesn't say a lot. You know, why use five words when one word will do? But he's clearly in charge. Now, when the leaks started happening, and these leaks from Conti came out in the wake of the war against Ukraine. When Russia reinvaded Ukraine in 2022, someone in the gang was clearly sympathetic to the Ukrainian side. Conti declared their support for Vladimir Putin's special operation, as he called it. And someone in the gang did not like that. So that's how these chats get leaked. Someone, a Ukraine supporting person with access to the chats, leaks, the whole lot. So we see Stern in those conversations. Obviously, it wasn't just journalists and researchers looking at those chats. Every law enforcement agency worth its salt was downloading the Conti leaks and trying to work out, you know, who was involved here. German police. The bka, the German sort of federal police looked into this. They put this information together with intelligence they had and they came out with a name, a man called Vitaly Kovalev, a Russian guy in his 30s, who they claim is the true face of Stern. We have got actually quite a lot of information about Stern as part of the podcast. We rummaged out videos on the Internet where he appears, and it's quite disconcerting because he, you know, in the podcast I've sort of said, look, Stern is the kind of guy, he looks like the kind of guy who, if you had a car crash or your car needed to push and you were looking around for somebody to help you, Stern looks like the kind of guy who'd help push your car. He looks very friendly and cheery, but actually he's alleged to be behind this giant crime ring. It's a very disconcerting thing seeing him face to face.

[Jeff White]

Did we have any insights onto his background, how he came to be in this position?

[Dave Bittner]

Well, yes, so it's interesting. I'm sure you found this, Dave, with cyber stories, they kind of get sometimes put together in hindsight so one thing happens and then another thing happens and you end up looking back down the telescope. But what we believe about this character Vitaly Kovalev, who went on to become Stern, is that he's got, according to law enforcement agencies, a very long career in cybercrime. Starts out as part of a group called Zeus, who again, you and your listeners may be familiar with the malware from way back when. Kovalo is accused of being part of the laundering network around Zeus, was working in the US around the time under the nickname Bentley and effectively got his start, I think there, that's the accusation against him, and then goes on to set up his own gang and then eventually goes on to head up Conti. So that's the sort of genesis, certainly putting the pieces together from the bka, the Department of Justice in the US and the National Crime Agency in the uk. That's the timeline they sort of see. And so you see this very, very long, decade long career, if those allegations are correct, in crime.

[Jeff White]

Do you have any sense for how the leadership of this group maintained order? What could they hold against someone?

[Dave Bittner]

In terms of their victims, you mean, or their employees?

[Jeff White]

The employees.

[Dave Bittner]

Well, the employees. It's really interesting in that they have a certain amount of power because they are creating the malware. I mean, fundamentally at the heart of any ransomware operation is the ransomware, the encryption software. And what's interesting is my impression of those guys is they're coders, that they exist to write very, very good code that encrypts lots of data very quickly. That's your job. But getting that ransomware onto a system, well, that involves sending phishing emails, potentially carrying out blagging operations where you phone up help desks and trick them into installing it. There's a whole sort of phishing social engineering side of this. The coders in ransomware gangs are not necessarily the best at that. So they outsource it. And this is the affiliate network, they outsource it to others. And in terms of the control they exert, it's interesting. There is, and I'm sure this is not news to you, there's a sort of pendulum swing that goes back and forwards in terms of power between the affiliates and the ransomware operators. The ransomware operators need the affiliates to spread the stuff, but the affiliates, they're the ones who actually end up infecting the victims and making the money. And actually the split of money, I think, reflects that. Often we've seen a split of money, 80% going to the affiliate and 20 going back to the ransomware gang. That implies to me that the power's on the affiliate side and the ransomware gangs are in a competitive marketplace. In fact, one of the gangs I was reading about today, Brian Krebs, has been blogging about this. The gentleman ransomware Group was offering 90% to the affiliates. So there's a marketplace. And you see this in the chats, you see this in the Conte chats. They're talking about how much other gangs are offering, what split they're offering. Can we compete? It's a competitive marketplace.

[Jeff White]

We'll be right back. This episode is supported by Black Hat usa. If you follow the research, you know, a lot of it breaks on. Black Hat stages hundreds of peer reviewed briefings, more than a hundred hands on trainings, and the largest business hall in Black Hat's history. Six days to learn the skills you'll need tomorrow, August 1st through the 6th. Use code CYBERWIRE for $200 off your briefings [e-mail] we'll see you in Vegas. Are all batteries the same? That's like asking if all soccer players are the same. Take Messi, the most decorated player ever. Is there any other player who has

[Dave Bittner]

a chance achieve that?

[Jeff White]

No, just saying. Now take Duracell. Is there any other battery with power boost ingredients inside? No, just Duracell. Remember, goats only trust goats because they're built different. And Messi only trusts Duracell. One of the fascinating elements of your research involved the internal debates about targeting healthcare organizations. Take us through that.

[Dave Bittner]

Yes, healthcare obviously is a very contentious target. You know, this is the point where cybercrime turns very, very real world effects indeed. In the uk we had in the past year the first confirmed death as a result of a ransomware attack. You know, for the family that lost their family member. The idea that a cyberattack took your relative's life away, that's a horrific thing to contend with. And even if not that, we've seen operations, very, very, very, very sensitive operations and very sought after operations being rescheduled. So it's not just the deaths, it's the suffering of people and the psychological suffering. So healthcare is contentious. I think there's this sense that, oh, these ransomware gangs don't care, they'll just hit hospitals. They've hit hospitals before. From what we see in the Conti leagues, it's not that simple. There's a very wide range of opinions all the way from people who, in the case of some people in Conti, one particular guy called Target was extremely aggressive and basically deliberately hit hospitals during the pandemic knowing that at that stage it was likely those hospitals would want to pay up. But you see all the way at the other end, you see other operators saying, we don't hit healthcare. Now, questions about why that is, you know, is that a moral outlook, an ethical standpoint, or do they just realize that if you attack a hospital, you are going to have a target on your back from every law enforcement agency in the world? I don't know. I don't know. I think it's probably a bit of both. But healthcare certainly is an interesting one for them. And the other thing is that certainly in the uk, very unlikely a healthcare operator in the UK would pay up. I mean, we have the National Health Service. They generally don't pay. But obviously in the us, Well, I think you are, Dave. There are private hospitals who will pay. So again, knowing the nuances of the territory you're attacking, that's not always something that ransomware gangs know.

[Jeff White]

I think there was another incident involving the Saudi royal family. Share that with us.

[Dave Bittner]

Yes. This was an astonishing moment in the evolution of Conti. The Conti gang broke into a jeweller called Graff, the famous Graff diamonds company, who sell, obviously jewels to all sorts of very, very rich famous people around the world. Conti did what they always do, which is scramble Graff's data and then steal a bunch of data. The reason for that is if victims refused to pay up to have their data unscrambled, Conti would simply say, well, you may not want your data unscrambled, maybe you've got a backup, but we've also got your data and we'll leak it onto the Internet if you don't pay. This is a double extortion technique. Exactly what they did to Graph. Graff played hardball, did not want to pay. So Conti decided they would put the squeeze on the victim and they would start leaking some snippets of Graph's customer data that they'd stolen in. That was data about famous people. Donald Trump, David Beckham apparently were in there. The Daily Mail wrote an article about this in the uk. Now, what the gang had not realized, Conti had not realized was in amongst the data leak that they put out was data about the Saudi royal family. Now, there were people in the world that you want to upset and there were people that you don't. I would definitely put the Saudis in the latte camp. We don't know what happens next. What we do know because of the leaks is that the Conti Gang really, they really got scared about this. There's talk about the fact you could be disappeared as a result of this. You've upset some powerful people. They won't like this. We then get an apology from the Conti gang to the Saudi royal family individually saying, we're very sorry for any inconvenience caused. They then thanked the Daily Mail for pointing this out, which came as a big shock to the Daily Mail journalist. And then the Conti gang said, we're very sorry. We'll of course delete the Saudi royal family's data. Now thanks to the leaks. We know they did no such thing. And in fact, there's a brilliant snippet which was rummaged out by actually a private tech security firm called Syjax who went through some of the leaks with us and helped us with it. And they found this great snippet where one of the gang members talks about the Saudi leak and says, we can shake and shake with the shakes. That is. They've got the shakes, the Saudi sheikhs data. And they will shake them down later on. They will hang on to this data. So when they tell you they delete your data, these ransomware gangs, they're almost certainly lying.

[Jeff White]

Well, one more specific story, there was an arrest in Miami that got the gang's attention. What was going on there?

[Dave Bittner]

Yeah. So again, the gang had to recruit and they had to be quite careful about how they recruited. And with any organized crime enterprise, you have a challenge about how many people you tell, because the more people you tell, the more vulnerable you are. So they would recruit people as sort of techies and coders initially, and then gradually inculcate them into the gang and expose more to them. One of the people they recruited was a woman called Alan Vita, who's actually from Latvia. She worked as a coda. She thought it was just a remote work job. She didn't really ask many questions. She then realized over time this was a criminal operation. She actually ended up in Suriname for reasons that we go into in the podcast. It's quite weird. Suriname's tiny country in South America. The US government started looking into Conti, and with Alavita, they didn't have to do much research. She actually hosted some of the malware on her own website, Alavita Nl. So finding her name wasn't. Wasn't that big of an investigation. The US government tracked her down to Suriname, where unfortunately, she and her partner had overstayed their visas. So the US government said to the Suriname government, you know, if you attempted to extradite These people, could you fly them perhaps via Miami? So Alavitta gets a knock on the door one day, ends up in Miami and is then under custody in the us. Now, interesting, because of the leaks around Conti, we know what their reaction to this was. Weirdly, it took them quite a while to notice this. One of the gang members had to report to the senior management, to Stern, look, you do realise one of your people's been arrested. They then go into emergency panic mode because they realise alivet can spill all the secrets or even if she just gives them the password, the conversations will be potentially on her laptop or her devices. So they start working out, how can they spring Allah out of prison? And one of the big issues is they've got a lawyer. They have a friendly lawyer in the US who knows the system, but how do you pay the lawyer without your money being seized or tracked? They were trying to work out, like, have we got money in the US that we can somehow free up to pay this lawyer? Because it's going to cost us hundreds of thousands. So they kind of go into overdrive now. We don't know what happens with that process in the end. We do know Alavitta was eventually convicted. She'd by this point been in custody for quite some time. So I think she got a couple of years, was then put on a flight back to Riga and is now back in Riga. And actually a German journalist managed to track her down and interview her. And we've spoken to that journalist for the podcast and we've got snippets of Alla and she's honestly, she's the classic criminal cutout. Didn't ask many questions, didn't really want to know, just happy to do the job. And I don't know about you, Dave, I've come across that in multiple cases where there's just some person who just doesn't ask enough questions and they end up in a crime gang. It's not that happens.

[Jeff White]

I'm curious, you know, I think we all have an idea in our mind of what a cybercrime group is like and the people who are involved with them. As you were going through all these messages, did it challenge your assumptions about who these people were as you got to know them?

[Dave Bittner]

I'd always. It's a very common cliche in the business to describe cybercrime as a business, you know, in the cybersecurity industry. Oh, It's a business 9 to 5. I'd always known that, but it really did just bring it absolutely home to me. The mundanity of what they were doing, you know, the staffing issues they had to deal with, the, you know, fallouts between different team members. Oh, this person hasn't logged on, or I'm having trouble with this software. It's only when you've. I've not thought of this before, but it's only when you've read 47,000 messages, quite a lot of which are very boring, that you realize quite how mundane and businesslike this operation was. They thought about the same stuff every organization thinks about. Recruitment, retention, strategy, reputation, you know, these were all things that Conti thought about and thought about quite deeply. So, yeah, I find that interesting. And I found that interesting juggling that against the fact that they couldn't get away from the headwinds that a criminal operation still has. You can't trust each other. You don't know who you're working with. People don't hang around because they haven't signed contracts. They can flit at any time. They can flip on you at any time. So no matter how businesslike Compton got, it still had the Achilles heel that a lot of crime gangs have. The fact that you. You can't trust who you're working with.

[Jeff White]

Yeah. As they ultimately unraveled, how does the information that you have, being able to look in on these conversations sort of in the rearview mirror, how does that inform your understanding of what ultimately led to their downfall?

[Dave Bittner]

Well, the conversations between Conti members, the internal chats, got leaked in February to March 2022 as the war in Ukraine was starting to break out. Conti did one last, which was the government of Costa Rica, which is quite a step up. They'd attacked local government before, they'd attacked big companies. But to go after an entire government was quite a change. They did manage to take down parts of Costa Rica's government's infrastructure. The treasury import exports were affected. Taxes, pensions, government payments to government employees. And what was interesting was it wasn't just Conti. In the end, Costa Rica became a sort of pylon of different groups. Now, what's interesting about that is we don't know why that happened, because at that point, the Conti gang was starting, had disintegrated largely. Max Smeets, who's an author, who wrote an academic also who wrote a great book called Ransomwar, has various theories for this, and I think he's done a good job of summing them up. You know, was this a last swan song to say, well, you know, mic drop, we're out of here? Was this somebody trying to say, well, Conti's not gone, we're still here, you can still use us. Was it a rogue affiliate who just went after a government? Had Conti at that point merged into some kind of nation state activity? We don't know. All we know is that's the last one that's attributed under the Conti name. We think Conti's members went on to set up new gangs to become affiliates in other gangs. But that's the sort of the swan song, if you like, of Conti. The death of Conti.

[Jeff White]

After all this research, were there any particular things that stayed with you personally?

[Dave Bittner]

The thing that really stayed with me was an interview that we did with a woman who is based in Ireland. And Conti, in 2021 attacked the Irish Health Service, the National Health Service of Ireland, did huge damage. I mean, it was just, it was absolute chaos there. This woman had a very rare form of cancer and she'd actually had the chemotherapy. She'd largely beaten the cancer. But there's a final course of radiotherapy. I've never had this experience, you know, thankfully, with a family member. But these operations are so precise that you need to target the radiotherapy at exactly the right bit. It was in her brain, this particular cancer. And so she was on the final stretch. But there were these final moments of, okay, I've got six appointments left and they'll do these exactly targeted, precise radiotherapy treatments and then I'll be free, I've beaten it, I'm done. And she gets the phone call to say, sorry, the operation's off. And then she has the moment of looking at the doctors, writing down the coordinates for the therapy treatment in pen, which would normally be on a computer. They had to type them in manually into the computer because they'd lost the records. And she's looking and thinking, if they get a coordinate wrong, this doesn't work, this treatment doesn't work. That's how close to the wire you get. And so something like that, being something like that makes you realize we think of cyber attacks as often being quite spreadsheet, quite white collar, quite digital, but real people really suffer. And that's not to mention all the people up there, people listen to this podcast who deal with defending against this stuff, who have to pull 18 hour days, seven days a week to clear this mess up.

[Jeff White]

Our thanks to Jeff White, BBC journalist and host of cyberhack, for joining us. We'll have a link to his work on the Conti ransomware group in our show Notes. And that's Research Saturday brought to you by N2K CyberWire we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com this episode was produced by Liz Stokes, were mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin, Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time. Foreign. Reynolds here for Mint Mobile. Are you looking for a beach read this summer? May I suggest your big wireless bill? It's got suspense, mystery, a slightly flat emotional arc, and a shocking twist where you realize you've been overpaying the entire time. Fortunately, though, Mint's story is better. Every plan $15 a month, even unlimited. That's it. Happy ending, zero tears. Give it a [e-mail] Switch upfront payment

[Dave Bittner]

of $45 for three months, $90 for six months, or $180 for a 12 month plan required $15 per month equivalent taxes and fees Extra initial plan term only greater than 50 gigabytes may slow when network is busy.

[Jeff White]

C terms.