Disgruntled Conti Ransomware Affiliate Leaks Info on Gang
In a dog eat dog turn of events, an affiliate working for the Conti ransomware gang has leaked information on the criminal group's methodology and operations. The affiliate was apparently angry because the Conti gang undercut his payment.
The Conti ransomware gang operates using a ransomware-as-service model - something that has become almost the norm when it comes to larger criminal organizations who deal in ransomware. The model constitutes a sort of an illegal revenue sharing plan where the affiliates execute the attacks and then split any ransom money paid with the hackers who set up and run the ransomware and its infrastructure.
A security researcher caught the post made by the angered Conti gang affiliate on an underground forum. The affiliate posted a significant infodump on the gang's operations and the way they operate. The information disclosed in the post included addresses of CobaltStrike command and control servers used by Conti, as well as an archive file that contains tutorial materials that Conti uses for new affiliates and other assorted tools.
The revenue share that takes place between the ransom group operating the infrastructure and their affiliates can vary but the split the affiliates receive is usually in the ballpark of 20 to 30 percent. In this case, the angry affiliate only received $1,500 and accused Conti of looking for "suckers" to do the dirty work for them without receiving their promised cut.
On the basis of the information, tools and training materials leaked, researcher Vitali Kremez tweeted out a couple of security tips on how to protect networks from Conti ransomware. Those included scanning systems for "unauthorized Atera Agent installations" and checking for Any Desk persistence. Atera was one of the tools that Conti use alongside CobaltStrike beacons before they move on to deploy the final payload of the ransomware.
A separate researcher tweeted out a set of IPs associated with Conti to be blocked immediately to improve security. The batch included the following:
162.244.80.235
85.93.88.165
185.141.63.120
82.118.21.1
Those are the same addresses that showed up in the forum leak as used by the Conti gang.
