‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
A mysterious leaker going by the alias GangExposed has been revealing the identities of individuals linked to the Conti and Trickbot ransomware groups.
The data includes aliases, photos, and videos of several group members and their front companies, along with thousands of chat logs, personal videos, and ransom negotiations with victims.
The Register has spoken to the whistleblower via Signal, who said the leaks were a "fight against an organized society of criminals known worldwide", adding, "I take pleasure in thinking I can rid society of at least some of them."
GangExposed claimed that Stern - the leader of TrickBot and Conti - is actually 36-year-old Russian national Vitaly Nikolaevich Kovalev. This was later confirmed by German police.
Another major player, Professor, has been named as 39-year-old Russian Vladimir Viktorovich Kvitko, who allegedly lives in Dubai.
"Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members," GangExposed said.
"Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., 'Target') display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The Trickbot ransomware group, also known as Wizard Spider, has been active since at least 2016 and has used a number of other malware variants as well as the Trickbot malware after which it was named.
Conti, meanwhile, was first observed in 2019, and is believed to have merged with Trickbot in the last two years.
GangExposed claims to have obtained the leaked data via semi-closed databases, dark web services, and purchased information. Similarly, the individual reportedly has access to a leaked FSB border control database being sold on the dark web.
He said he plans to expose around 50 gang members in all.
GangExposed leaks could have major repercussions
David Sancho, senior threat researcher at Trend Micro, said the leaks could have serious repercussions for members of the notorious ransomware groups.
"The GangExposed leak will have serious reverberations for those who led the Conti group in its active years. The individual behind the leaks is either an insider from the group or has managed to hack the inner circle," Sancho said.
"Either is damaging. If the individuals unmasked as key Conti figures are still in Dubai as the leak claims, then they will either be plotting their way back to Russia or already on their way. Past law enforcement action against cyber criminals has shown how Dubai can be cooperative with Western law enforcement."
Sancho added that the leak is likely to attract attention and follow-up from the authorities.
"Law enforcement isn’t always a fast-moving animal but when this kind of information is leaked, wheels start moving and law enforcement is unrelenting in tracking individuals down and making arrests," he said.
MORE FROM ITPRO
- INSERT STORY LINK
- INSERT STORY LINK
- INSERT STORY LINK

Ross Kelly is ITPro's News & Analysis Editor, responsible for leading the brand's news output and in-depth reporting on the latest stories from across the business technology landscape. Ross was previously a Staff Writer, during which time he developed a keen interest in cyber security, business leadership, and emerging technologies.
He graduated from Edinburgh Napier University in 2016 with a BA (Hons) in Journalism, and joined ITPro in 2022 after four years working in technology conference research.
For news pitches, you can contact Ross at ross.kelly@futurenet.com, or on Twitter and LinkedIn.
-
Tomorrow's fraud techniquesITPro Podcast Leaders need to proactive as attackers launch more consistent, sophisticated attacks
-
Met Office hails huge efficiency gains in first year of cloud supercomputing with Microsoft AzureNews In moving to the cloud, the Met Office has bolstered operational resilience and helped to deliver more accurate forecasts
-
Interpol teams up with tech firms to seize 45,000 malicious IPs, servers in global cyber crime crackdownNews Operation Synergia III saw 94 arrests - and counting - with malicious IP addresses used in phishing and fraud schemes seized
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Cloudflare warns state-backed hackers are ‘weaponizing legitimate enterprise ecosystems’ as ‘living off the land’ attacks surgeNews Chinese, North Korean, and Russian-backed threat groups now favor longer-term compromises over brute force attacks
-
DIY hackers are turning to ‘flat-pack’ malware components to speed up attacks and cut costsNews While these malware campaigns are very basic, researchers noted “they still work”
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Security expert warns Salt Typhoon is becoming 'more dangerous' after Norwegian authorities lift lid on critical infrastructure hacking campaignNews The Chinese state-backed hacking group has waged successful espionage campaigns against an array of organizations across Norway.
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites