For around two years the Conti Ransomware Group rampaged across the internet. They attacked hospitals, educational institutions, businesses, governments, and many more, raking in hundreds of millions of dollars in ransomware payments. Business was booming for the cybercriminals. At least it was until the Russian President Vladimir Putin announced the full-scale invasion of Ukraine. The Conti leadership quickly pledged their loyalty to Russia and then everything began to fall apart.This is the story of one of the most professional, prolific, and devastating organized cybercriminal groups in history.Speaker(s):Selina Larson – Senior Threat Intelligence Analyst and <a href="https://www.proofpoint.com/uk/taxonomy/term/11741#126411" rel="noopener noreferrer" target="_blank">DISCARDED Podcast</a> Co-host at <a href="https://www.proofpoint.com/uk" rel="noopener noreferrer" target="_blank">Proofpoint</a> - <a href="https://twitter.com/selenalarson?lang=en" rel="noopener noreferrer" target="_blank">Twitter</a>Berk Albayrak, Threat Intelligence Analyst within the <a href="https://www.prodaft.com/" rel="noopener noreferrer" target="_blank">PRODAFT</a> Threat Intelligence team and expert on Wizard Spider - <a href="https://twitter.com/brkalbyrk7?lang=en" rel="noopener noreferrer" target="_blank">Twitter</a><a href="https://www.irishtimes.com/author/conor-gallagher/" rel="noopener noreferrer" target="_blank">Conor Gallagher</a> – Crime and Security Correspondent of the Irish Times - <a href="https://twitter.com/conorgallaghe_r?lang=en" rel="noopener noreferrer" target="_blank">Twitter</a><a href="https://www.sans.org/profiles/allan-liska/" rel="noopener noreferrer" target="_blank">Allan Liska</a>, Threat Intelligence Analyst at <a href="https://www.recordedfuture.com/" rel="noopener noreferrer" target="_blank">Recorded Future</a> and author of <a href="https://ransomware.org/book/" rel="noopener noreferrer" target="_blank">Ransomware: Understand. Precent. Recover</a>. - <a href="https://twitter.com/uuallan" rel="noopener noreferrer" target="_blank">Twitter</a><a href="https://www.linkedin.com/in/juan-ignacio-nicolossi-baeza-286b035a/" rel="noopener noreferrer" target="_blank">Juan Ignacio Nicolossi</a>, the team leader for the Threat Intelligence Team at <a href="https://www.prodaft.com/" rel="noopener noreferrer" target="_blank">PRODAFT</a>.Zoë Brammer, Cyber & Information Operations Associate at the <a href="https://securityandtechnology.org/team/core-team/zoe-brammer/" rel="noopener noreferrer" target="_blank">Institute for Security and Technology</a> - <a href="https://securityandtechnology.org/wp-content/uploads/2022/11/Mapping-the-Ransomware-Payment-Ecosystem.pdf" rel="noopener noreferrer" target="_blank">Ransomware Ecosystem Map</a><a href="https://twitter.com/Jake_MooreUK" rel="noopener noreferrer" target="_blank">Jake Moore</a>, Global Cybersecurity Advisor for&nbsp;<a href="https://www.eset.com/" rel="noopener noreferrer" target="_blank">ESET</a>.Artwork by Paulina Rosol-BarrassAdditional Reading:﻿Reports/Papers:<a href="https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf" rel="noopener noreferrer" target="_blank">PRODAFT - Conti Ransomware Group In-Depth Analysis</a>PRODAFT - <a href="https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf" rel="noopener noreferrer" target="_blank">Wizard Spider In-Depth Analysis</a>Google - <a href="https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/" rel="noopener noreferrer" target="_blank">Fog of War: How the Ukraine Conflict Transformed the Cyber Threat Landscape</a>DISCARDED Podcast (Proofpoint) - <a href="https://www.proofpoint.com/us/podcasts/discarded?page=2" rel="noopener noreferrer" target="_blank">Defending Against Cyber Criminals: Emotet’s Resurrection & Conti’s Implosion</a> - April 12 2022pwc - <a href="https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf" rel="noopener noreferrer" target="_blank">Conti cyber attack on the HSE: Independent Post Incident Review</a>CNN - <a href="https://edition.cnn.com/2022/03/30/politics/ukraine-hack-russian-ransomware-gang/index.html" rel="noopener noreferrer" target="_blank">‘I can fight with a keyboard’: How one Ukrainian IT specialist exposed a notorious Russian ransomware gang</a>Proofpoint - <a href="https://www.proofpoint.com/uk/resources/threat-reports/human-factor" rel="noopener noreferrer" target="_blank">The Human Factor Report 2022 - Threat Report</a>Ransomware Task Force (Institute for Security and Technology - <a href="https://securityandtechnology.org/wp-content/uploads/2022/08/IST-Blueprint-for-Ransomware-Defense.pdf" rel="noopener noreferrer" target="_blank">Blueprint for Ransomware Defense</a>Ransomware Task Force (Institute for Security and Technology - <a href="https://securityandtechnology.org/ransomwaretaskforce/report/" rel="noopener noreferrer" target="_blank">Combating Ransomware</a>Ransomware Task Force (Institute for Security and Technology - <a href="https://securityandtechnology.org/wp-content/uploads/2022/11/Mapping-the-Ransomware-Payment-Ecosystem.pdf" rel="noopener noreferrer" target="_blank">MAPPING THE RANSOMWARE PAYMENT ECOSYSTEM</a> - <a href="https://www.youtube.com/watch?v=5QHMAyArMVM" rel="noopener noreferrer" target="_blank">Video: Mapping the Ransomware Payment Ecosystem & Opportunities for Friction</a>Ransomware Task Force (Institute for Security and Technology - <a href="https://securityandtechnology.org/wp-content/uploads/2023/05/Mapping-Threat-Actor-Behavior-in-the-Ransomware-Payment-Ecosystem-A-Mini-Pilot.pdf" rel="noopener noreferrer" target="_blank">MAPPING THREAT ACTOR BEHAVIOR IN THE RANSOMWARE PAYMENT ECOSYSTEM: A MINI-PILOT</a>Ransomware Task Force (Institute for Security and Technology - <a href="https://securityandtechnology.org/virtual-library/reports/ransomware-task-force-gaining-ground-may-2023-progress-report/" rel="noopener noreferrer" target="_blank">GAINING GROUND</a>Book - <a href="https://ransomware.org/book/" rel="noopener noreferrer" target="_blank">Ransomware: Understand. Precent. Recover</a>.Recorded Future - <a href="https://www.recordedfuture.com/business-fraud-botnet-malware-dissemination" rel="noopener noreferrer" target="_blank">The Business of Fraud: Botnet Malware Dissemination</a>Recorded Future - <a href="https://www.recordedfuture.com/russias-war-against-ukraine-disrupts-cybercriminal-ecosystem" rel="noopener noreferrer" target="_blank">Russia’s War Against Ukraine Disrupts the Cybercriminal Ecosystem</a><a href="https://sophos.com/threatreport" rel="noopener noreferrer" target="_blank">Sophos 2023 Threat Report</a>Sophos - <a href="https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/sophos-state-of-ransomware-2023-wp.pdf" rel="noopener noreferrer" target="_blank">The State of Ransomware 2023</a>Europol - <a href="https://www.tbstat.com/wp/uploads/2020/06/Europol-Wasabi-Wallet-Report.pdf" rel="noopener noreferrer" target="_blank">Wasabi Wallet Report</a>vmware - <a href="https://www.vmware.com/content/dam/learn/en/amer/fy23/pdf/1669005_Emotet_Exposed_A_Look_Inside_the_Cybercriminal_Supply_Chain.pdf" rel="noopener noreferrer" target="_blank">Emotet Exposed: A Look Inside the Cybercriminal Supply Chain</a>Krebs on Security - <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" rel="noopener noreferrer" target="_blank">Conti Ransomware Group Diaries</a>Elliptic - <a href="https://www.elliptic.co/resources/conti-leaks-investigation" rel="noopener noreferrer" target="_blank">Conti Leaks Investigation</a> - The $19m in DAI found in an account linked to Conti Member ‘Target<a href="https://go.chainalysis.com/2022-Crypto-Crime-Report.html" rel="noopener noreferrer" target="_blank">The Chainalysis 2022 Crypto Crime Report</a><a href="https://go.chainalysis.com/2023-crypto-crime-report.html" rel="noopener noreferrer" target="_blank">The Chainalysis 2023 Crypto Crime Report</a>AdvIntel - <a href="https://www.databreaches.net/discontinued-the-end-of-contis-brand-marks-new-chapter-for-cybercrime-landscape/" rel="noopener noreferrer" target="_blank">DisCONTInued: The End of Conti’s Brand Marks NewChapter For Cybercrime Landscape</a>FinCEN - <a href="https://www.fincen.gov/sites/default/files/2022-11/Financial%20Trend%20Analysis_Ransomware%20FTA%202_508%20FINAL.pdf" rel="noopener noreferrer" target="_blank">Ransomware Trends in Bank Secrecy Act Data Between January 2021 and June 2021</a>FinCEN - <a href="https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf" rel="noopener noreferrer" target="_blank">Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments</a>(Forescout) Vedere Labs - <a href="https://www.forescout.com/resources/analysis-of-conti-leaks/" rel="noopener noreferrer" target="_blank">Analysis of Conti Leaks</a>FATF - <a href="https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Professional-Money-Laundering.pdf" rel="noopener noreferrer" target="_blank">Professional Money Laundering</a>FATF - <a href="https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/sophos-state-of-ransomware-2023-wp.pdf" rel="noopener noreferrer" target="_blank">Targeted update on implementation of the FATF standards on virtual assets and virtual asset service providers</a>accenture - <a href="https://acn-marketing-blog.accenture.com/wp-content/uploads/2022/03/UPDATED-ACTI-Global-Incident-Report-Ideological-Divide-Blog-14MARCH22.pdf" rel="noopener noreferrer" target="_blank">Global Incident Report: Threat Actors Divide Along Ideological Lines over the Russia-Ukraine Conflict on Underground...

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

The Rise and Fall of the Conti Ransomware Group

Deep Dive: Exploring Organized Crime

AI Chapters

AI Insights

Reviews