‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
A mysterious leaker going by the alias GangExposed has been revealing the identities of individuals linked to the Conti and Trickbot ransomware groups.
The data includes aliases, photos, and videos of several group members and their front companies, along with thousands of chat logs, personal videos, and ransom negotiations with victims.
The Register has spoken to the whistleblower via Signal, who said the leaks were a "fight against an organized society of criminals known worldwide", adding, "I take pleasure in thinking I can rid society of at least some of them."
GangExposed claimed that Stern - the leader of TrickBot and Conti - is actually 36-year-old Russian national Vitaly Nikolaevich Kovalev. This was later confirmed by German police.
Another major player, Professor, has been named as 39-year-old Russian Vladimir Viktorovich Kvitko, who allegedly lives in Dubai.
"Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members," GangExposed said.
"Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., 'Target') display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles."
The Trickbot ransomware group, also known as Wizard Spider, has been active since at least 2016 and has used a number of other malware variants as well as the Trickbot malware after which it was named.
Conti, meanwhile, was first observed in 2019, and is believed to have merged with Trickbot in the last two years.
GangExposed claims to have obtained the leaked data via semi-closed databases, dark web services, and purchased information. Similarly, the individual reportedly has access to a leaked FSB border control database being sold on the dark web.
He said he plans to expose around 50 gang members in all.
GangExposed leaks could have major repercussions
David Sancho, senior threat researcher at Trend Micro, said the leaks could have serious repercussions for members of the notorious ransomware groups.
"The GangExposed leak will have serious reverberations for those who led the Conti group in its active years. The individual behind the leaks is either an insider from the group or has managed to hack the inner circle," Sancho said.
"Either is damaging. If the individuals unmasked as key Conti figures are still in Dubai as the leak claims, then they will either be plotting their way back to Russia or already on their way. Past law enforcement action against cyber criminals has shown how Dubai can be cooperative with Western law enforcement."
Sancho added that the leak is likely to attract attention and follow-up from the authorities.
"Law enforcement isn’t always a fast-moving animal but when this kind of information is leaked, wheels start moving and law enforcement is unrelenting in tracking individuals down and making arrests," he said.
MORE FROM ITPRO
- INSERT STORY LINK
- INSERT STORY LINK
- INSERT STORY LINK
-
Amazon OpenSearch update targets performance boosts and lower costsNews Surging data volumes have prompted an overhaul of Amazon’s OpenSearch service
-
Cyber experts say they've identified the first case of ‘agentic ransomware’News While the JadePuffer ransomware has alarm bells ringing, it still needed a human in the loop
-
‘The risk to every organization has increased exponentially’: The FortiBleed campaign just took a turn for the worseNews Reports suggest that FortiBleed-linked exposed credentials could put UK government and public services at huge risk
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
US offers $10m bounty for info on Russia-linked hackers behind Signal and WhatsApp attacksNews UNC5792 and UNC4221 have been targeting government officials through their Signal and WhatsApp accounts
-
Duo accused of role in TfL cyber attack plead guilty after ‘lengthy, highly complex, and painstaking investigation’News Around 10 million people are believed to have been affected by the TfL cyber attack
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
Hackers are turning up at law firms to gain physical access to machinesNews The FBI is warning companies to look out for fake IT staff
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
