A disgruntled Conti ransomware associate leaked the gang's training materials while conducting attacks, including information about one of the ransomware's operators.
The Conti Ransomware operation is run as ransomware-as-a-service (RaaS), where the core team manages the malware and Tor websites, while affiliated partners perform network breaches and encrypt devices.
See also: CISA: Collaboration with Microsoft, Google, Amazon to combat ransomware
See also: Energy group ERG hit by ransomware attack
As part of this arrangement, the core group earns 20-30% of the ransom, while affiliates earn the rest.
Today, a security researcher shared a post created by an angry collaborator of the Conti ransomware, which publicly leaked information about the ransomware’s operation. This information includes the IP addresses for the Cobalt Strike C2 servers and a 113 MB file containing numerous tools and training materials for carrying out ransomware attacks.
The associate said he posted the material as he was only paid $1,500 as part of an attack, while the rest of the group earns millions and promises large payouts after the victim pays a ransom.
Attached to the above post are images of Cobalt Strike containing the IP addresses for command and control servers used by the ransomware gang.
In a tweet from security researcher Pancak3, it is recommended that everyone block these IP addresses to prevent attacks from the group.
In a subsequent post, the collaborator shared an archive containing 111 MB of files, including hacking tools, manuals written in Russian, training materials, and help documents allegedly provided to collaborators when carrying out Conti ransomware attacks.
See also: Vaccine registration system in Italy hit by ransomware attack
A security researcher shared a screenshot of this extracted folder with BleepingComputer. He said it contains a manual for deploying Cobalt Strike, mimikatz for dropping NTLM hashes, and several other text files filled with various commands.
Advanced Intel's Vitali Kremez, who had already analyzed the file, told BleepingCompter that the training material matches the active Conti circumstances.
Information source: bleepingcomputer.com
