Conti (ransomware group)
A Russian-speaking ransomware group active from 2020 to 2022, run like a company, whose public pledge of support for Russia in February 2022 led to the leak of its internal chats and then its dissolution.
Conti operated less like an affiliate network than like a company: salaried staff, recruiting, negotiation teams, a budget. It practiced double extortion, encrypting systems and threatening to publish stolen data, and deliberately targeted hospitals and government agencies. Its case matters to insurance in two ways. It showed that a criminal group could paralyze a national public service, which blurs the line between cybercrime and an attack on a state. And its public pledge of support for the Russian government the day after the invasion of Ukraine raised a concrete question: does a group that declares itself on a state's side still fall under crime, or under the state operations that war exclusions target? The leak of its internal chats also documented its ties to Russian services.
On February 25, 2022, Conti announced its full support for the Russian government; two days later, a Ukrainian researcher began publishing tens of thousands of its internal messages. The FBI then attributed more than 1,000 victims and more than 150 million dollars in ransom payments to the group. In May 2022, the State Department offered up to 10 million dollars for information on its leaders, and the brand disappeared in the following weeks.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.