Conti Ransomware Gang

The Conti ransomware gang, a notorious threat actor in the cybersecurity landscape, has been responsible for extorting at least $180 million globally. The gang is infamous for the HSE cyberattack in 2021 and has been sanctioned by the National Crime Agency (NCA). In late 2021, experts suggested that the development of Trickbot, a powerful malware, was "acquired" by the Conti gang, further increasing its capabilities. This situation prompted the U.S. Department of State to offer a reward of $15 million to identify co-conspirators and provide information about anyone planning or attempting to participate in a Conti ransomware attack. In early 2022, a new group named Royal Ransomware emerged, composed of veterans from the Conti gang. This group has been launching attacks on US-based healthcare organizations, with a recent focus on Linux systems. However, the situation took a dramatic turn when Russia invaded Ukraine. On February 24, 2022, the day after the invasion began, the Conti gang declared its full support for the Russian government, pledging to use all possible resources to strike back at the critical infrastructures of any enemy. Although the group later condemned the war, the damage had already been done. A significant blow to the Conti gang came when their internal communications were leaked by a Ukrainian researcher following their declaration of support for Russia, an event known as the Conti Leaks. Additionally, in March 2023, the FBI reported that LockBit, another ransomware group, had assembled a team of experts for their research and development efforts, particularly after separating from the Conti gang. These developments indicate a shifting landscape in the world of cyber threats, with the potential for new actors and alliances to emerge.