‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs

A mysterious leaker going by the alias GangExposed has been revealing the identities of individuals linked to the Conti and Trickbot ransomware groups.

The data includes aliases, photos, and videos of several group members and their front companies, along with thousands of chat logs, personal videos, and ransom negotiations with victims.

The Register has spoken to the whistleblower via Signal, who said the leaks were a "fight against an organized society of criminals known worldwide", adding, "I take pleasure in thinking I can rid society of at least some of them."

GangExposed claimed that Stern - the leader of TrickBot and Conti - is actually 36-year-old Russian national Vitaly Nikolaevich Kovalev. This was later confirmed by German police.

Another major player, Professor, has been named as 39-year-old Russian Vladimir Viktorovich Kvitko, who allegedly lives in Dubai.

"Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members," GangExposed said.

"Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., 'Target') display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles."

The Trickbot ransomware group, also known as Wizard Spider, has been active since at least 2016 and has used a number of other malware variants as well as the Trickbot malware after which it was named.

Conti, meanwhile, was first observed in 2019, and is believed to have merged with Trickbot in the last two years.

GangExposed claims to have obtained the leaked data via semi-closed databases, dark web services, and purchased information. Similarly, the individual reportedly has access to a leaked FSB border control database being sold on the dark web.

He said he plans to expose around 50 gang members in all.

GangExposed leaks could have major repercussions

David Sancho, senior threat researcher at Trend Micro, said the leaks could have serious repercussions for members of the notorious ransomware groups.

"The GangExposed leak will have serious reverberations for those who led the Conti group in its active years. The individual behind the leaks is either an insider from the group or has managed to hack the inner circle," Sancho said.

"Either is damaging. If the individuals unmasked as key Conti figures are still in Dubai as the leak claims, then they will either be plotting their way back to Russia or already on their way. Past law enforcement action against cyber criminals has shown how Dubai can be cooperative with Western law enforcement."

Sancho added that the leak is likely to attract attention and follow-up from the authorities.

"Law enforcement isn’t always a fast-moving animal but when this kind of information is leaked, wheels start moving and law enforcement is unrelenting in tracking individuals down and making arrests," he said.

MORE FROM ITPRO

• INSERT STORY LINK
• INSERT STORY LINK
• INSERT STORY LINK