A mysterious leaker going by the alias GangExposed has been revealing the identities of individuals linked to the Conti and Trickbot ransomware groups.
The data includes aliases, photos, and videos of several group members and their front companies, along with thousands of chat logs, personal videos, and ransom negotiations with victims.
The Register has spoken to the whistleblower via Signal, who said the leaks were a "fight against an organized society of criminals known worldwide", adding, "I take pleasure in thinking I can rid society of at least some of them."
GangExposed claimed that Stern - the leader of TrickBot and Conti - is actually 36-year-old Russian national Vitaly Nikolaevich Kovalev. This was later confirmed by German police.
Another major player, Professor, has been named as 39-year-old Russian Vladimir Viktorovich Kvitko, who allegedly lives in Dubai.
"Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members," GangExposed said.
"Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., 'Target') display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles."
The Trickbot ransomware group, also known as Wizard Spider, has been active since at least 2016 and has used a number of other malware variants as well as the Trickbot malware after which it was named.
Conti, meanwhile, was first observed in 2019, and is believed to have merged with Trickbot in the last two years.
GangExposed claims to have obtained the leaked data via semi-closed databases, dark web services, and purchased information. Similarly, the individual reportedly has access to a leaked FSB border control database being sold on the dark web.
He said he plans to expose around 50 gang members in all.
GangExposed leaks could have major repercussions
David Sancho, senior threat researcher at Trend Micro, said the leaks could have serious repercussions for members of the notorious ransomware groups.
"The GangExposed leak will have serious reverberations for those who led the Conti group in its active years. The individual behind the leaks is either an insider from the group or has managed to hack the inner circle," Sancho said.
"Either is damaging. If the individuals unmasked as key Conti figures are still in Dubai as the leak claims, then they will either be plotting their way back to Russia or already on their way. Past law enforcement action against cyber criminals has shown how Dubai can be cooperative with Western law enforcement."
Sancho added that the leak is likely to attract attention and follow-up from the authorities.
"Law enforcement isn’t always a fast-moving animal but when this kind of information is leaked, wheels start moving and law enforcement is unrelenting in tracking individuals down and making arrests," he said.
MORE FROM ITPRO
- INSERT STORY LINK
- INSERT STORY LINK
- INSERT STORY LINK
-
Windows 10 extended support costs could top $7 billionNews Enterprises sticking with Windows 10 after the October deadline face huge costs
-
Why employee offboarding poses huge cybersecurity risksNews Enterprises should act swiftly to revoke rights and access, regardless of the manner of an employee’s departure.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
The Allianz Life data breach just took a huge turn for the worseNews Around 1.1 million Allianz Life customers are believed to have been impacted in a recent data breach, making up the vast majority of the insurer's North American customers.
-
Warning issued as new Pakistan-based malware group hits millions globallyNews Tempting people in with offers of pirated software, the network installs commodity infostealers, according to CloudSEK
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
