An anonymous researcher under the pseudonym GangExposed has launched a large-scale information war against the cybercriminal group Conti. He is publishing personal data, photos, and videos of key participants (including Russians) — from administrators to ringleaders who directed attacks from the UAE.
An anonymous researcher under the pseudonym GangExposed has launched a large-scale information war against the cybercriminal group Conti. He is publishing personal data, photos, and videos of key participants (including Russians) — from administrators to ringleaders who directed attacks from the UAE.
GangExposed, who calls himself an independent investigator with no IT background, has already identified several leaders of the Conti group, including «Stern» — 36-year-old Russian Vitaly Kovalev — and «Professor» — 39-year-old Vladimir Kvitko. Both, he says, moved to Dubai in 2020 to direct large-scale cyberattacks on Western companies from there. The Register reports.
Internal chats, videos from private jets, and photos of gang members, including a birthday party for one of the leaders, «Target,» were made public. GangExposed also published personal information about the group’s system administrator, «Defender» (Andriy Zhuykov), and the manager, «Mango» (Mykhailo Tsarev).
It is one of the most notorious ransomware groups, linked to multi-billion dollar attacks on healthcare facilities, corporations, and government agencies. In 2022, their data was leaked in a large-scale manner, but GangExposed took the exposure to a new level, going beyond cyberactivity and publishing personal data, asset information, and movements of those involved.
According to analysts at FalconFeeds, this is no longer just a leak — but a «high-risk intelligence operation.» In turn, Technisanct CEO Nandakishore Harikumar believes that a former Conti member with deep inside access may be behind the leak.
GangExposed says it is not interested in the $10 million reward from the US for information on the ringleaders because it «enjoys the process of the investigation itself.» It claims to have access to FSB border control databases, records of income through corrupt channels, and also buys information on the darknet.
Recall that earlier in our news feed, we published an article about how the Chinese group APT41 created new malware called ToughProgress, which uses Google Calendar as a channel for communication with the command and control server.
