The Conti Leaks and Long-Standing International Security Puzzles

• In Event: Cyber War in Ukraine and Beyond

Abstract

Internal regional political disagreements and complaints about poor pay tore apart the Conti ransomware group and resulted in the unprecedented leak of its internal chats and records in 2021 and 2022. The leak included over 200,000 messages, descriptions of Conti attack infrastructure, tools, and scripts. It was a treasure trove of primary source information--extremely valuable to political scientists--about the inner workings of this prolific cybercriminal group. I examine the leak to answer cybersecurity puzzles such as the relationship between state-sponsored threat actors and non-state threat actors--particularly cybercriminals and hacktivists; how cyber experts with a legitimate day job "moonlight" as cybercriminals on the dark web after work hours; and whether there is any indication that the US DOJ method of publicly indicting and naming and shaming specific individuals is becoming an effective form of deterrence.

Author

• David An, UC Berkeley