WEBVTT NOTE This file was generated by Descript 00:00:00.000 --> 00:00:01.180 JACK: [Music] There’s a kind of silence 00:00:01.180 --> 00:00:03.219 that follows a ransomware attack. 00:00:04.670 --> 00:00:06.480 Your throat gets dry, your chest gets a 00:00:06.480 --> 00:00:08.310 little heavy, and everything around you 00:00:08.330 --> 00:00:10.679 goes silent, especially when you see texts 00:00:10.679 --> 00:00:13.150 like this flash across your screen; ‘All 00:00:13.150 --> 00:00:14.980 of your files are currently encrypted. 00:00:15.190 --> 00:00:16.379 If you try to ignore us…’ 00:00:16.859 --> 00:00:17.859 CONTI: We’ve downloaded your 00:00:17.879 --> 00:00:19.589 data and are ready to publish it. 00:00:20.500 --> 00:00:21.700 JACK: You don't know who’s on 00:00:21.709 --> 00:00:23.080 the other side of that ransomware 00:00:23.080 --> 00:00:24.919 note or just how much damage they 00:00:24.920 --> 00:00:26.229 may cause if you don't pay up. 00:00:26.650 --> 00:00:27.820 The most fearsome enemy 00:00:27.939 --> 00:00:29.449 is the one you can't see. 00:00:30.230 --> 00:00:32.279 That silence, pulsating fear, can be 00:00:32.369 --> 00:00:35.179 deafening as it creeps across hospitals 00:00:35.360 --> 00:00:37.380 trying to treat patients or business 00:00:37.380 --> 00:00:39.190 owners trying to make payroll or 00:00:39.190 --> 00:00:41.110 teachers running a class full of kids. 00:00:41.879 --> 00:00:43.149 CONTI: The time is almost over. 00:00:43.619 --> 00:00:44.929 We need your decision. 00:00:45.450 --> 00:00:47.410 If we don't receive any reply to this 00:00:47.410 --> 00:00:50.189 message, we begin publishing your data. 00:00:51.199 --> 00:00:52.909 Conti is here to prevent 00:00:53.020 --> 00:00:54.489 any further damages. 00:00:55.459 --> 00:00:57.159 JACK: For years there was a group 00:00:57.279 --> 00:00:59.399 that called themselves Conti, and they 00:00:59.469 --> 00:01:01.649 wreaked havoc across the internet. 00:01:02.059 --> 00:01:03.749 CONTI: Conti is here to 00:01:03.750 --> 00:01:06.249 prevent any further damages. 00:01:06.799 --> 00:01:07.999 JACK: Hackers operate behind 00:01:08.000 --> 00:01:09.559 a curtain, known mostly by the 00:01:09.559 --> 00:01:10.850 destruction they leave behind. 00:01:11.019 --> 00:01:12.659 We rarely hear or see them. 00:01:13.309 --> 00:01:14.549 They want to remain covered 00:01:14.559 --> 00:01:15.649 up in the shadows under the 00:01:15.650 --> 00:01:17.240 guise of codes and keystrokes. 00:01:17.939 --> 00:01:19.429 But what happens when that curtain 00:01:19.540 --> 00:01:21.309 gets yanked and suddenly their 00:01:21.309 --> 00:01:22.619 deepest, darkest secrets are 00:01:22.619 --> 00:01:24.190 exposed for the whole world to see? 00:01:24.860 --> 00:01:26.099 Not just their threats against 00:01:26.099 --> 00:01:27.899 us, but their arguments, 00:01:28.080 --> 00:01:30.110 their insecurities, and fears? 00:01:31.470 --> 00:01:31.579 Intro: [Intro music] 00:01:34.799 --> 00:01:36.279 These are true stories from 00:01:36.279 --> 00:01:37.699 the dark side of the internet. 00:01:41.680 --> 00:01:43.089 I’m Jack Rhysider. 00:01:44.250 --> 00:01:46.050 This is Darknet Diaries. 00:02:02.079 --> 00:02:02.660 JACK: When I think about the 00:02:02.669 --> 00:02:04.360 lifespan of a Russian cyber gang, 00:02:04.369 --> 00:02:05.669 there’s an image that comes to mind. 00:02:05.919 --> 00:02:08.299 It’s that Russian nesting doll. 00:02:08.529 --> 00:02:09.639 You know those wooden 00:02:09.639 --> 00:02:10.920 dolls that stack together? 00:02:11.099 --> 00:02:12.409 They stack inside each other. 00:02:12.770 --> 00:02:13.799 They start small and then they 00:02:13.800 --> 00:02:14.879 get bigger and bigger and bigger. 00:02:15.309 --> 00:02:16.409 Russian hackers kind of 00:02:16.419 --> 00:02:17.689 operate in the same way. 00:02:18.050 --> 00:02:19.699 One tiny group starts it. 00:02:19.699 --> 00:02:20.539 They're at the center. 00:02:20.849 --> 00:02:22.299 Then they develop more and 00:02:22.300 --> 00:02:23.470 more layers around them. 00:02:23.509 --> 00:02:25.280 They get bigger and more influential 00:02:25.629 --> 00:02:27.229 and can rack up millions of dollars 00:02:27.229 --> 00:02:28.550 and leave a trail of destruction. 00:02:29.119 --> 00:02:30.869 These Russian cybercriminals seem to be 00:02:30.879 --> 00:02:32.859 untouchable by the Western authorities. 00:02:32.869 --> 00:02:35.139 The FBI and Europol can't go into Russia 00:02:35.199 --> 00:02:37.669 to arrest them, but they can issue arrest 00:02:37.669 --> 00:02:39.299 warrants for them in case they trip 00:02:39.309 --> 00:02:41.069 up or fly somewhere outside of Russia. 00:02:41.279 --> 00:02:42.200 They might get arrested. 00:02:42.779 --> 00:02:43.650 But you might think that 00:02:43.669 --> 00:02:45.069 when the cybercriminal gets 00:02:45.069 --> 00:02:46.359 arrested, it’s all over, right? 00:02:46.660 --> 00:02:47.789 Well, not exactly. 00:02:48.259 --> 00:02:50.180 Like those nesting dolls, when a cyber 00:02:50.180 --> 00:02:52.619 gang forms an outer shell, it forms 00:02:52.619 --> 00:02:55.019 into something else, sometimes something 00:02:55.019 --> 00:02:57.060 even more sinister, and it keeps 00:02:57.060 --> 00:02:59.260 happening over and over until they're 00:02:59.340 --> 00:03:01.430 splintering cells, each one learning from 00:03:01.430 --> 00:03:02.989 the other, each one working together. 00:03:03.410 --> 00:03:05.260 That’s how I think about Conti, 00:03:05.430 --> 00:03:06.560 one of the most successful 00:03:06.560 --> 00:03:08.110 ransomware gangs in history. 00:03:08.410 --> 00:03:09.700 [Music] But before I get into 00:03:09.700 --> 00:03:11.069 Conti, let’s back up a bit and take 00:03:11.070 --> 00:03:12.220 a look at where they came from. 00:03:12.549 --> 00:03:14.489 Before them were other ransomware groups. 00:03:14.559 --> 00:03:16.309 There was the Dyre gang 00:03:16.699 --> 00:03:17.349 and there was TrickBot. 00:03:18.389 --> 00:03:19.659 A central person in both of 00:03:19.660 --> 00:03:21.280 those was a Russian crime boss 00:03:21.289 --> 00:03:22.829 who went by the name Bentley. 00:03:23.570 --> 00:03:25.369 Bentley was an entrepreneur at 00:03:25.389 --> 00:03:27.480 heart and found creative ways to 00:03:27.480 --> 00:03:29.429 launder his cybercrime profits. 00:03:29.500 --> 00:03:31.289 In order to securely access profits 00:03:31.299 --> 00:03:33.000 from cybercrime, this Bentley 00:03:33.000 --> 00:03:34.840 character created side hustles to 00:03:35.070 --> 00:03:36.969 launder his cybercrime profits. 00:03:37.430 --> 00:03:38.819 It’s a hard problem that hackers 00:03:38.820 --> 00:03:39.979 have to figure out all the time. 00:03:40.500 --> 00:03:42.010 How do you turn ransomware 00:03:42.010 --> 00:03:43.699 payments, stolen credit card data, 00:03:43.700 --> 00:03:45.399 or crypto into something you can 00:03:45.399 --> 00:03:47.519 buy without leaving a paper trail? 00:03:48.039 --> 00:03:49.259 It’s where the business of illegal 00:03:49.279 --> 00:03:50.989 hacking meets the real world. 00:03:51.860 --> 00:03:54.110 Bentley’s big idea was to use his 00:03:54.110 --> 00:03:56.659 proceeds from the Dyre ransomware gang 00:03:57.039 --> 00:04:00.120 to create a film production company. 00:04:00.989 --> 00:04:02.349 I guess his idea was that if he 00:04:02.349 --> 00:04:04.109 can make a film with dirty money 00:04:04.439 --> 00:04:05.809 and then that film makes actual 00:04:05.809 --> 00:04:07.529 money, then that money is clean. 00:04:07.769 --> 00:04:08.689 GEOFF: They’re winding up with so much 00:04:08.709 --> 00:04:10.530 money that they needed some vehicle 00:04:10.540 --> 00:04:11.589 through which to wash the money. 00:04:11.939 --> 00:04:12.619 JACK: That’s Geoff White. 00:04:12.619 --> 00:04:13.460 He’s a good friend of the show. 00:04:13.460 --> 00:04:14.859 He’s an investigative journalist out 00:04:14.860 --> 00:04:16.439 of London, and he’s been reporting 00:04:16.439 --> 00:04:17.869 on some of the world’s most prolific 00:04:17.869 --> 00:04:20.009 hackers from the US to North Korea 00:04:20.029 --> 00:04:22.059 to Russia, and he hosts the new BBC 00:04:22.500 --> 00:04:25.119 podcast on Conti called The Conti Files. 00:04:25.570 --> 00:04:27.329 Geoff says Bentley’s film production 00:04:27.329 --> 00:04:29.519 company was called the 25th Floor Film 00:04:29.519 --> 00:04:32.519 Company, housed in a skyscraper in Moscow. 00:04:33.049 --> 00:04:34.990 Now, this wasn't just an idea of 00:04:34.990 --> 00:04:37.240 Bentley’s; they were making actual films. 00:04:37.769 --> 00:04:38.429 GEOFF: Obviously they have to make 00:04:38.430 --> 00:04:39.419 some films, 'cause if you're gonna 00:04:39.419 --> 00:04:40.199 have a front company, it’s got to 00:04:40.199 --> 00:04:42.359 actually do some of the work that the 00:04:42.439 --> 00:04:43.930 front company is supposed to be doing. 00:04:44.250 --> 00:04:45.180 So, they thought, well, 00:04:45.229 --> 00:04:46.259 what films should we make? 00:04:46.470 --> 00:04:47.749 JACK: They worked on some movies and 00:04:47.750 --> 00:04:49.879 television shows in Russia and surrounding 00:04:49.879 --> 00:04:51.599 countries, and they also produced 00:04:51.610 --> 00:04:54.099 action films with A-list American stars. 00:04:54.110 --> 00:04:54.969 Like, there was this movie 00:04:54.969 --> 00:04:56.889 called Exposed starring Keanu 00:04:56.909 --> 00:04:58.519 Reeves, which was made by them. 00:04:58.889 --> 00:04:59.690 KEANU: Nobody’s talking, 00:04:59.979 --> 00:05:00.709 and I don't blame them. 00:05:01.339 --> 00:05:03.429 He’s dead, he’s dead, she’s dead, 00:05:03.429 --> 00:05:04.859 but somebody knows something. 00:05:05.820 --> 00:05:07.230 JACK: Bentley knew all the ins and 00:05:07.230 --> 00:05:10.319 out of the cybercrime underworld, 00:05:11.209 --> 00:05:13.120 and he had a film production company, 00:05:13.160 --> 00:05:15.270 and this made him start to think. 00:05:16.680 --> 00:05:17.319 GEOFF: [Music] Hilariously, they 00:05:17.319 --> 00:05:18.740 decided they would make a film about 00:05:18.740 --> 00:05:20.260 a group of Russian computer hackers 00:05:21.259 --> 00:05:22.220 which was gonna be called Botnet. 00:05:23.379 --> 00:05:25.210 This film they were gonna make — when 00:05:25.210 --> 00:05:27.239 I spoke to the screenwriter guy called 00:05:27.239 --> 00:05:29.939 David Kaplan, who was recruited in 00:05:29.940 --> 00:05:31.380 Hollywood — some Russian guys came 00:05:31.380 --> 00:05:32.529 up to him at a party and suggested 00:05:32.539 --> 00:05:33.870 he might like to write this film. 00:05:35.009 --> 00:05:37.140 Then when he starts researching it, he 00:05:37.140 --> 00:05:38.829 went over to Russia to meet the film 00:05:38.830 --> 00:05:40.550 company not realizing that the very 00:05:40.550 --> 00:05:42.149 building the film company was based in 00:05:42.389 --> 00:05:43.810 was also the same building where the 00:05:43.810 --> 00:05:46.299 hackers were working on this malware. 00:05:47.250 --> 00:05:48.469 They described the plot to him and 00:05:48.469 --> 00:05:49.539 they sort of said, well, there’s 00:05:49.539 --> 00:05:50.710 gonna be this guy in charge. 00:05:50.710 --> 00:05:52.289 Gonna be some big, bald guy, and there’s 00:05:52.289 --> 00:05:54.109 gonna be this smart number-two guy, and 00:05:54.110 --> 00:05:55.389 then there’s gonna be a glamorous woman. 00:05:55.389 --> 00:05:57.190 All these people were actually real 00:05:57.210 --> 00:06:00.420 characters, real people in the Dyre gang. 00:06:00.720 --> 00:06:03.469 You know, Bentley, the guy who went on to 00:06:03.470 --> 00:06:04.900 become Stern, who went on to run Conti, 00:06:05.510 --> 00:06:06.530 was gonna be one of the characters in 00:06:06.530 --> 00:06:08.559 the film, and apparently they had a plan 00:06:08.740 --> 00:06:10.260 that they were going to come across to 00:06:10.260 --> 00:06:11.900 Hollywood, and actually shop this around 00:06:11.900 --> 00:06:13.429 and try and get some funding for it. 00:06:13.730 --> 00:06:16.469 So, it’s just — I can never get over this. 00:06:16.539 --> 00:06:17.899 In order to launder the profits from 00:06:17.900 --> 00:06:20.069 cybercrime, they created a film company, 00:06:20.219 --> 00:06:21.640 and then were gonna use the film company 00:06:21.900 --> 00:06:23.760 to make a film about the same cybercrime 00:06:23.760 --> 00:06:25.179 they were using to make the profits 00:06:25.179 --> 00:06:26.349 to launder through the film company. 00:06:26.529 --> 00:06:28.000 It’s just — it’s genius 00:06:28.079 --> 00:06:29.380 in a way, evil genius. 00:06:30.079 --> 00:06:31.640 JACK: A critical rule in the hacker 00:06:31.640 --> 00:06:33.970 underground is don't dox yourself. 00:06:34.340 --> 00:06:35.409 It’s really rule number one. 00:06:35.409 --> 00:06:37.100 If you're doing cybercrime, you've 00:06:37.119 --> 00:06:39.030 gotta use fake names, fake addresses, 00:06:39.030 --> 00:06:40.660 burner e-mails, burner phones. 00:06:40.950 --> 00:06:42.609 You can't trust anyone you're working 00:06:42.610 --> 00:06:44.299 with because if they know who you 00:06:44.299 --> 00:06:45.529 are and they get compromised, now 00:06:45.529 --> 00:06:46.929 suddenly you're compromised, too. 00:06:47.469 --> 00:06:48.960 The best operators in the world 00:06:49.250 --> 00:06:50.839 are the ones you've never heard of. 00:06:51.039 --> 00:06:52.799 Silence is their shield. 00:06:53.349 --> 00:06:54.939 People in this world who can't 00:06:54.949 --> 00:06:56.980 resist telling their stories are 00:06:56.980 --> 00:06:59.099 often the first to get caught. 00:06:59.459 --> 00:07:01.129 So, it’s wildly surprising that 00:07:01.159 --> 00:07:03.139 Bentley and even the people around 00:07:03.150 --> 00:07:04.919 him in the Dyre gang were thinking 00:07:04.930 --> 00:07:07.930 about making essentially a documentary 00:07:07.930 --> 00:07:09.180 about their ransomware gang. 00:07:09.720 --> 00:07:11.460 But in the end Bentley never 00:07:11.460 --> 00:07:12.849 reached his dreams of making his 00:07:12.879 --> 00:07:14.120 big break with this movie, Botnet. 00:07:15.159 --> 00:07:16.469 Those dreams came crashing 00:07:16.470 --> 00:07:18.529 down at the end of 2015. 00:07:18.939 --> 00:07:21.259 GEOFF: Now, tragic end to the 25th Floor 00:07:21.259 --> 00:07:22.920 Film Company and indeed the Dyre gang. 00:07:22.920 --> 00:07:23.900 They actually got raided 00:07:23.959 --> 00:07:25.860 by the Russian authorities. 00:07:26.639 --> 00:07:27.429 We don't know why. 00:07:27.680 --> 00:07:29.039 Clearly they fell foul of the 00:07:29.040 --> 00:07:30.320 Russian authorities somehow. 00:07:31.019 --> 00:07:32.399 [Music] Off the back of that, out of 00:07:32.400 --> 00:07:34.830 the ashes of that emerges a new group. 00:07:35.290 --> 00:07:37.340 Now, that group, initially called 00:07:37.340 --> 00:07:39.919 TrickBot, starts to morph as they use 00:07:39.919 --> 00:07:43.259 ransomware, and the ransomware strain 00:07:43.259 --> 00:07:44.069 that they use — 'cause different 00:07:44.110 --> 00:07:45.289 types of ransomware — the ransomware 00:07:45.289 --> 00:07:46.109 strain they used was called Conti. 00:07:46.829 --> 00:07:49.149 So, eventually the Dyre gang becomes 00:07:49.149 --> 00:07:50.619 TrickBot, and eventually TrickBot is known 00:07:50.619 --> 00:07:52.229 as Conti, and from then on they're just 00:07:52.229 --> 00:07:53.469 known as the Conti gang, 'cause they're 00:07:53.469 --> 00:07:56.169 using Conti ransomware to infect victims. 00:07:56.500 --> 00:07:57.259 JACK: Now you're starting to see 00:07:57.259 --> 00:07:58.710 these Russian nesting dolls stacking 00:07:58.710 --> 00:08:00.030 up one on top of each other, 00:08:00.030 --> 00:08:01.449 layers upon layers in the group. 00:08:01.779 --> 00:08:03.019 Within all these variations of 00:08:03.019 --> 00:08:05.119 hacking gangs, leaders like Bentley 00:08:05.119 --> 00:08:06.220 learned how to recruit other 00:08:06.220 --> 00:08:08.289 members of this growing empire. 00:08:08.410 --> 00:08:11.399 GEOFF: It’s astonishingly astute and 00:08:11.410 --> 00:08:13.619 driven and organized group of people. 00:08:14.529 --> 00:08:15.289 As you say, recruiting 00:08:15.289 --> 00:08:16.349 was a key part of it. 00:08:16.569 --> 00:08:18.289 They were able to recruit people 00:08:18.309 --> 00:08:22.090 through Russian job-seeker sites. 00:08:22.659 --> 00:08:23.839 They were obviously very cagey 00:08:23.869 --> 00:08:25.119 about what the operation was. 00:08:25.119 --> 00:08:25.789 They would say, do you want to 00:08:25.789 --> 00:08:27.649 join in a fast-moving startup? 00:08:27.970 --> 00:08:29.250 JACK: One of those early hires 00:08:29.250 --> 00:08:31.240 was a Latvian computer programmer 00:08:31.559 --> 00:08:33.539 who went by the name Max. 00:08:34.319 --> 00:08:35.559 Now, when I first heard that there’s 00:08:35.559 --> 00:08:37.289 a computer programmer in the Conti 00:08:37.289 --> 00:08:39.359 gang named Max, the first thought 00:08:39.360 --> 00:08:40.599 I had was, of course there is. 00:08:40.599 --> 00:08:41.909 Max is a very popular 00:08:42.160 --> 00:08:43.400 classic hacker handle. 00:08:43.739 --> 00:08:45.129 This guy’s probably watched too many 00:08:45.129 --> 00:08:46.909 hacker movies and he probably wears 00:08:46.929 --> 00:08:48.809 hoodies and has this computer that’s 00:08:48.940 --> 00:08:50.749 got LEDs inside the case and stuff. 00:08:51.110 --> 00:08:52.680 But actually, this Max is 00:08:52.729 --> 00:08:54.119 opposite of what I pictured. 00:08:54.519 --> 00:08:57.490 Max is chatty, middle-aged, and 00:08:57.490 --> 00:09:00.360 a woman from Latvia, a mom, even. 00:09:00.700 --> 00:09:03.150 Her actual name is Alavita. 00:09:03.150 --> 00:09:04.459 She spoke with a journalist and 00:09:04.460 --> 00:09:06.230 the BBC translated her responses. 00:09:06.420 --> 00:09:08.100 MAX: A long time ago I graduated 00:09:08.100 --> 00:09:09.709 from Latvian State University. 00:09:09.839 --> 00:09:10.520 JACK: Max grew up in the 1980s 00:09:11.260 --> 00:09:13.000 in Soviet Union and managed to 00:09:13.000 --> 00:09:14.539 pick up coding work in Russia. 00:09:14.889 --> 00:09:16.799 Max has a degree in applied mathematics 00:09:16.799 --> 00:09:18.079 and wanted more than anything 00:09:18.080 --> 00:09:19.520 to become a computer programmer. 00:09:19.689 --> 00:09:21.399 She got married, had kids, 00:09:21.609 --> 00:09:22.920 and moved all the way to a 00:09:22.920 --> 00:09:25.289 tiny country in South America. 00:09:25.529 --> 00:09:26.999 MAX: There I continued to work with 00:09:27.000 --> 00:09:28.849 Russians, but it was all uncertain 00:09:28.880 --> 00:09:30.430 from one project to the next. 00:09:31.299 --> 00:09:33.549 I wanted more stability and didn't want 00:09:33.549 --> 00:09:35.849 to work alone, just my client and I. 00:09:36.340 --> 00:09:37.450 JACK: So, she’s looking for a job. 00:09:37.459 --> 00:09:38.430 Computer programming is what 00:09:38.430 --> 00:09:39.340 she always wanted to do. 00:09:39.700 --> 00:09:40.940 She comes across a talent 00:09:40.950 --> 00:09:42.469 boot camp for coders. 00:09:42.709 --> 00:09:44.729 MAX: I attended this three-day webinar. 00:09:45.089 --> 00:09:47.389 Your CV kind of goes into circulation, 00:09:47.719 --> 00:09:49.220 and a potential employer can 00:09:49.250 --> 00:09:50.919 come across it and even reach 00:09:50.919 --> 00:09:52.789 out with some kind of invitation. 00:09:53.270 --> 00:09:54.399 JACK: Max sends her resume, and 00:09:54.399 --> 00:09:55.679 someone responds to see if she 00:09:55.680 --> 00:09:56.859 wants to join their company. 00:09:57.270 --> 00:09:58.460 She didn't ask a lot of questions 00:09:58.460 --> 00:09:59.874 about who this company was, and 00:09:59.874 --> 00:10:01.260 she didn't get a lot of information 00:10:01.619 --> 00:10:02.709 because Max thought that’s just 00:10:02.709 --> 00:10:04.469 how it goes in the land of coders. 00:10:04.470 --> 00:10:05.799 As part of the job application, 00:10:05.889 --> 00:10:07.190 she was asked to take a test. 00:10:07.510 --> 00:10:08.309 MAX: So, I said that 00:10:08.309 --> 00:10:09.320 I will take this test. 00:10:09.689 --> 00:10:11.480 It was quite complicated, but I 00:10:11.489 --> 00:10:13.489 solved everything and sent them a 00:10:13.489 --> 00:10:15.310 link so they could see the results. 00:10:15.310 --> 00:10:17.609 The week after, they write back to 00:10:17.610 --> 00:10:19.409 me, okay, you've passed the test. 00:10:19.669 --> 00:10:20.660 When can you start? 00:10:21.080 --> 00:10:23.649 I’m like, if you want, right today. 00:10:24.110 --> 00:10:25.339 JACK: She gets the job and starts 00:10:25.349 --> 00:10:26.489 getting to know her coworkers. 00:10:26.919 --> 00:10:28.649 Everyone is remote. 00:10:28.769 --> 00:10:30.430 Now, remember, Max is living in South 00:10:30.430 --> 00:10:33.029 America, so it feels a bit isolating. 00:10:33.319 --> 00:10:34.510 [Music] There’s some water-cooler 00:10:34.510 --> 00:10:35.929 talk over Jabber messenger, 00:10:36.399 --> 00:10:37.649 but something feels off. 00:10:37.849 --> 00:10:39.880 None of her coworkers are 00:10:39.880 --> 00:10:41.109 using their actual names. 00:10:41.110 --> 00:10:42.439 Instead, they're using strange 00:10:42.519 --> 00:10:45.369 nicknames like Professor or Snow White 00:10:45.669 --> 00:10:48.649 or Adelina, simple, random nicknames. 00:10:49.209 --> 00:10:50.689 Then there was one other thing; 00:10:50.959 --> 00:10:53.309 no one on the team wanted 00:10:53.309 --> 00:10:54.829 to do a video chat with her. 00:10:55.219 --> 00:10:57.609 MAX: I asked if we wanted to Skype, but 00:10:57.629 --> 00:10:59.269 they said that they were just chatting. 00:11:00.119 --> 00:11:01.149 I like good jokes. 00:11:01.209 --> 00:11:02.089 That’s why I wrote 00:11:02.139 --> 00:11:03.179 ironically in the email. 00:11:03.809 --> 00:11:05.439 Ah, maybe you're the kind of 00:11:05.440 --> 00:11:07.060 hackers you hear so much about. 00:11:07.720 --> 00:11:09.879 He answered me, no, we are not hackers. 00:11:10.800 --> 00:11:11.399 JACK: But soon enough, 00:11:11.500 --> 00:11:12.619 she learned the truth. 00:11:12.949 --> 00:11:14.409 Her boss gives her a link to a 00:11:14.410 --> 00:11:16.530 page that had some wording on it. 00:11:16.919 --> 00:11:18.200 She’s told to use what was on 00:11:18.200 --> 00:11:20.199 the site as a template for other 00:11:20.199 --> 00:11:21.910 sites, and that’s all she knows. 00:11:22.000 --> 00:11:23.049 The page loads. 00:11:23.080 --> 00:11:25.330 She sees the gears turning, turning. 00:11:25.849 --> 00:11:27.209 Max stares at her screen. 00:11:27.399 --> 00:11:29.039 Scrolling text comes across it, 00:11:29.500 --> 00:11:31.329 and it starts to come into focus. 00:11:31.669 --> 00:11:32.570 MAX: There was text. 00:11:33.080 --> 00:11:34.729 Your computer is infected, 00:11:34.729 --> 00:11:37.219 blah, blah, blah, so pay money. 00:11:37.720 --> 00:11:38.759 JACK: It’s a template 00:11:38.899 --> 00:11:40.509 for a ransomware note. 00:11:41.019 --> 00:11:43.270 This was the first time Max 00:11:43.270 --> 00:11:45.049 realized she’s not just a computer 00:11:45.050 --> 00:11:46.830 programmer for some tech company. 00:11:47.369 --> 00:11:49.440 She’s a programmer for a cybercriminal 00:11:49.440 --> 00:11:51.399 enterprise, where at the center 00:11:51.449 --> 00:11:52.730 was Bentley, who had pieced it 00:11:52.730 --> 00:11:53.660 all together from the rubble 00:11:53.660 --> 00:11:55.440 of the 25th Floor Film Company. 00:11:55.810 --> 00:11:57.689 This is the moment where Max goes 00:11:57.710 --> 00:11:59.380 from being an innocent computer 00:11:59.380 --> 00:12:02.300 programmer to knowingly being part of 00:12:02.300 --> 00:12:04.639 an international cybercrime syndicate, 00:12:05.049 --> 00:12:06.850 which has to be some decision, right? 00:12:07.320 --> 00:12:08.670 Like, when you realize you're 00:12:08.670 --> 00:12:10.380 infecting the world with ransomware, 00:12:10.380 --> 00:12:12.449 do you say, oh no, that’s against 00:12:12.480 --> 00:12:14.619 my ethics, or do you just shrug your 00:12:14.619 --> 00:12:15.799 shoulders and say, you know what? 00:12:15.910 --> 00:12:16.549 It’s good pay. 00:12:16.650 --> 00:12:17.180 Why not? 00:12:17.490 --> 00:12:18.749 GEOFF: At that point she 00:12:18.750 --> 00:12:19.790 decides to stick with it. 00:12:19.790 --> 00:12:21.459 Actually, at that point she’s 00:12:21.459 --> 00:12:22.820 living very far away from home. 00:12:22.820 --> 00:12:24.639 She’s living actually in 00:12:24.639 --> 00:12:25.599 Suriname in South America. 00:12:26.520 --> 00:12:27.789 I think she felt like she was very 00:12:27.790 --> 00:12:31.519 far away from any risks, maybe, there. 00:12:31.549 --> 00:12:33.009 She felt she was just working — by 00:12:33.009 --> 00:12:33.870 this point she realized she’s 00:12:33.899 --> 00:12:35.600 working for a ransomware gang. 00:12:36.469 --> 00:12:37.400 But I think she felt quite 00:12:37.430 --> 00:12:38.889 insulated and also felt that her 00:12:38.889 --> 00:12:40.560 role was fairly puny within this. 00:12:40.579 --> 00:12:42.290 It’s a classic thing where — I think she 00:12:42.290 --> 00:12:43.950 justified it to herself of, well, you 00:12:43.950 --> 00:12:45.989 know, I’m not really doing any hacking; 00:12:45.989 --> 00:12:47.519 I’m just doing some coding for them. 00:12:48.529 --> 00:12:49.409 JACK: [Music] Over the years Max 00:12:49.410 --> 00:12:51.079 became a bigger and bigger part 00:12:51.079 --> 00:12:52.310 of their ransomware operations. 00:12:52.619 --> 00:12:54.199 While her focus is web design and 00:12:54.209 --> 00:12:56.300 web development, investigators said 00:12:56.519 --> 00:12:58.410 because of her language skills, she was 00:12:58.410 --> 00:13:00.660 able to help write ransomware notes. 00:13:00.919 --> 00:13:03.400 GEOFF: Now, Max wasn't massively great 00:13:03.430 --> 00:13:06.629 at operational security because she ends 00:13:06.629 --> 00:13:08.329 up hosting some of the Conti ransomware 00:13:08.330 --> 00:13:10.809 code apparently on her own website in her 00:13:10.849 --> 00:13:15.170 own name — Alavita is her name — and had 00:13:15.170 --> 00:13:17.500 also done some YouTube videos at the time, 00:13:17.500 --> 00:13:19.389 so it was also identifiable from those. 00:13:20.369 --> 00:13:21.879 It could be that her security was 00:13:21.879 --> 00:13:23.039 rubbish or it could be that she just 00:13:23.040 --> 00:13:25.229 didn't realize how at risk she was. 00:13:25.229 --> 00:13:26.449 JACK: This was the early stages of 00:13:26.449 --> 00:13:28.149 the Conti ransomware group forming, 00:13:28.459 --> 00:13:29.789 and they had already began infecting 00:13:29.790 --> 00:13:31.479 systems and getting paid when 00:13:31.479 --> 00:13:33.249 somebody wanted the decryption key, 00:13:33.529 --> 00:13:34.959 which of course was starting to draw 00:13:34.979 --> 00:13:37.059 attention of the US authorities. 00:13:37.409 --> 00:13:39.219 They began investigating who’s 00:13:39.220 --> 00:13:42.119 behind Conti, which led them to Max. 00:13:42.309 --> 00:13:43.130 Soon they discovered her 00:13:43.130 --> 00:13:43.639 real name was Alavita. 00:13:45.119 --> 00:13:45.909 They found that she was 00:13:45.909 --> 00:13:47.180 living in South America. 00:13:47.439 --> 00:13:48.269 They found out that she 00:13:48.269 --> 00:13:49.399 actually overstayed her 00:13:49.399 --> 00:13:51.719 Visa while in South America. 00:13:52.239 --> 00:13:53.870 So, the US authorities worked with 00:13:53.870 --> 00:13:55.479 the local authorities there to find 00:13:55.489 --> 00:13:58.209 her and get them to fly her home to 00:13:58.290 --> 00:14:00.789 Russia because she overstayed her Visa. 00:14:01.679 --> 00:14:04.089 But they purposely put her on a flight 00:14:04.099 --> 00:14:06.049 to Miami to make her connection to 00:14:06.050 --> 00:14:08.719 Russia, and when she landed in Miami, 00:14:09.099 --> 00:14:11.080 she was arrested by US authorities. 00:14:11.759 --> 00:14:13.100 This was the first person to 00:14:13.110 --> 00:14:14.939 go down in the Conti group. 00:14:15.559 --> 00:14:16.880 They were charging her with her 00:14:16.880 --> 00:14:19.010 involvement with TrickBot and Conti. 00:14:19.429 --> 00:14:21.389 At this point TrickBot was working 00:14:21.389 --> 00:14:23.069 closely with the Conti ransomware gang, 00:14:23.309 --> 00:14:24.459 and soon they would merge together. 00:14:24.489 --> 00:14:26.059 Conti was going to acquire TrickBot. 00:14:26.069 --> 00:14:28.439 Conti ransomware was becoming 00:14:28.739 --> 00:14:30.400 sort of a service where you 00:14:30.400 --> 00:14:32.089 could be an affiliate of theirs. 00:14:32.089 --> 00:14:33.550 You could use the Conti ransomware 00:14:33.550 --> 00:14:35.310 to infect a network somewhere, and 00:14:35.310 --> 00:14:37.169 then once infected, the Conti team 00:14:37.169 --> 00:14:38.089 would then take it from there, 00:14:38.089 --> 00:14:40.089 negotiating payment, handing over 00:14:40.199 --> 00:14:42.029 decryption keys, et cetera, and then 00:14:42.089 --> 00:14:43.450 the affiliate would get a cut of it. 00:14:44.039 --> 00:14:46.060 A few months after Max’s arrest, 00:14:46.149 --> 00:14:47.849 hackers using the Conti ransomware 00:14:47.859 --> 00:14:50.490 launched a devastating attack that put 00:14:50.490 --> 00:14:53.280 Conti on the map of the world stage. 00:14:57.320 --> 00:14:59.070 [Music] In the early days of the 00:14:59.070 --> 00:15:01.580 pandemic, someone burrowed their way 00:15:01.639 --> 00:15:04.180 deep into Ireland’s hospital network. 00:15:04.740 --> 00:15:06.170 The initial intrusion happened 00:15:06.190 --> 00:15:07.699 when a hospital employee opened 00:15:07.699 --> 00:15:09.899 a phishing e-mail containing a 00:15:09.900 --> 00:15:12.759 malicious Microsoft Excel attachment. 00:15:13.340 --> 00:15:14.960 They clicked it, they opened 00:15:14.960 --> 00:15:16.780 it, they got infected. 00:15:17.279 --> 00:15:18.849 That was Patient Zero. 00:15:19.730 --> 00:15:22.610 Attackers got in and opened up a backdoor 00:15:22.610 --> 00:15:24.779 so they could stay in, and then they 00:15:24.779 --> 00:15:27.289 began making that infection spread. 00:15:27.739 --> 00:15:29.179 Dozens of infected 00:15:29.180 --> 00:15:30.939 machines became hundreds. 00:15:31.129 --> 00:15:33.040 One infected hospital became 00:15:33.099 --> 00:15:35.489 two, which quickly spread to ten. 00:15:35.869 --> 00:15:38.100 Thousands of machines were infected, 00:15:38.239 --> 00:15:39.990 and the infection kept spreading across 00:15:39.990 --> 00:15:41.929 clinics and offices and more hospitals. 00:15:41.980 --> 00:15:43.550 Thousands of machines were 00:15:43.550 --> 00:15:44.979 hit with this ransomware. 00:15:45.929 --> 00:15:48.309 In total, over 70,000 computers were 00:15:48.309 --> 00:15:52.049 infected at 4,000 locations, and 00:15:52.049 --> 00:15:54.450 over forty hospitals were infected 00:15:55.049 --> 00:15:56.990 within the Ireland hospital network. 00:15:58.029 --> 00:16:01.349 It just sat there quiet, waiting for the 00:16:01.349 --> 00:16:04.910 right moment to lock up all the computers. 00:16:08.059 --> 00:16:09.000 GEOFF: I sometimes liken it 00:16:09.000 --> 00:16:09.850 to being a burglar, you know? 00:16:09.850 --> 00:16:11.239 You break into a house. 00:16:11.250 --> 00:16:11.960 It’s dark. 00:16:12.229 --> 00:16:12.809 You have no idea of the 00:16:12.809 --> 00:16:13.709 layout of the house. 00:16:14.220 --> 00:16:15.250 So, you just have to kind of keep 00:16:15.250 --> 00:16:16.879 opening doors, and you hope that 00:16:16.900 --> 00:16:18.689 the door you open isn't the one into 00:16:18.689 --> 00:16:21.249 the bedroom where the people who are 00:16:21.249 --> 00:16:22.859 in the house are there with a gun. 00:16:24.319 --> 00:16:26.419 There is a long process of scoping it out. 00:16:27.239 --> 00:16:27.870 Of course, at any moment 00:16:27.879 --> 00:16:28.979 you might get caught. 00:16:28.979 --> 00:16:30.360 Your access might be revealed. 00:16:30.879 --> 00:16:32.209 JACK: After weeks of lurking in the 00:16:32.209 --> 00:16:34.939 network shadows, the hackers struck. 00:16:35.229 --> 00:16:36.230 REPORTER: Ireland’s health service 00:16:36.230 --> 00:16:37.829 describing this as a significant 00:16:37.829 --> 00:16:39.929 ransomware attack, the people 00:16:39.939 --> 00:16:41.580 asking how an attack like this could 00:16:41.580 --> 00:16:42.949 have happened in the first place. 00:16:43.159 --> 00:16:44.290 SPEAKER: There’s no doubt it is a 00:16:44.470 --> 00:16:46.559 vicious and a callous act and will be 00:16:46.559 --> 00:16:48.409 condemned everywhere by decent people. 00:16:48.930 --> 00:16:50.760 JACK: It was total pandemonium. 00:16:50.799 --> 00:16:53.529 Ireland’s healthcare system was hit with 00:16:53.529 --> 00:16:55.579 the most devastating ransomware attack 00:16:55.619 --> 00:16:58.130 they had ever seen by a Russian-based 00:16:58.140 --> 00:17:00.679 cybercrime gang called Conti. 00:17:01.119 --> 00:17:02.540 Every hospital in the Irish 00:17:02.540 --> 00:17:04.849 network felt Conti’s attack. 00:17:05.389 --> 00:17:06.989 To keep track of patient appointments 00:17:06.989 --> 00:17:09.109 and records, clinicians just had to 00:17:09.110 --> 00:17:11.599 use pen and paper like the old days. 00:17:12.119 --> 00:17:14.570 The attack disrupted Covid and blood 00:17:14.570 --> 00:17:16.970 work tests, all this as Ireland 00:17:16.979 --> 00:17:18.659 was in its third wave of the Covid 00:17:18.679 --> 00:17:21.130 pandemic, its longest lockdown yet. 00:17:21.279 --> 00:17:21.969 GEOFF: This is the middle of a 00:17:21.970 --> 00:17:23.650 pandemic, and as you say, people in 00:17:23.650 --> 00:17:25.629 Ireland, they speak their minds, the 00:17:25.690 --> 00:17:27.969 Irish, and they absolutely hated this. 00:17:28.000 --> 00:17:29.040 Why would people attack a 00:17:29.059 --> 00:17:30.599 health service, and particularly 00:17:30.599 --> 00:17:31.689 during the middle of a pandemic? 00:17:32.009 --> 00:17:33.679 JACK: Maternity wards and pediatric 00:17:33.679 --> 00:17:35.349 units were thrown into chaos. 00:17:35.599 --> 00:17:36.140 GEOFF: This is basically an 00:17:36.140 --> 00:17:37.540 entire country’s hospital system 00:17:37.540 --> 00:17:39.159 being held to ransom in one go. 00:17:39.279 --> 00:17:40.229 Absolutely stunning. 00:17:40.709 --> 00:17:42.359 JACK: It was unlike anything that they 00:17:42.599 --> 00:17:44.449 — well, actually, we have ever seen before. 00:17:44.949 --> 00:17:46.389 The information systems behind 00:17:46.389 --> 00:17:47.659 all these hospitals went into 00:17:47.659 --> 00:17:49.629 a tailspin, a total scramble. 00:17:49.860 --> 00:17:52.060 GEOFF: Health services classically do not 00:17:52.879 --> 00:17:55.419 prioritize IT security because they've 00:17:55.420 --> 00:17:57.050 got lots of other things to prioritize, 00:17:57.050 --> 00:17:58.205 and they generally don't think that 00:17:58.205 --> 00:17:59.769 they're gonna be a target for hackers. 00:17:59.770 --> 00:18:01.690 They haven't been, historically. 00:18:02.099 --> 00:18:03.240 JACK: Those patients ended 00:18:03.240 --> 00:18:04.850 up paying a big price. 00:18:04.859 --> 00:18:06.230 One person who Geoff actually 00:18:06.230 --> 00:18:08.210 talked to who lived in Dublin went 00:18:08.210 --> 00:18:10.339 through a particularly awful cancer 00:18:10.340 --> 00:18:11.699 treatment, a brain cancer treatment. 00:18:11.869 --> 00:18:13.699 But when the cyberattack happened, she 00:18:13.699 --> 00:18:15.260 was getting ready for a highly-targeted 00:18:15.260 --> 00:18:17.510 cancer treatment involving lasers zapping 00:18:17.510 --> 00:18:19.240 the cancer in these precise spots. 00:18:19.809 --> 00:18:21.660 But with computers down, the doctors 00:18:21.669 --> 00:18:23.040 had to cancel her appointment, 00:18:23.520 --> 00:18:25.000 so she had to wait even longer 00:18:25.029 --> 00:18:26.540 to get her cancer irradiated. 00:18:27.180 --> 00:18:29.419 Stories like these began to flood 00:18:29.419 --> 00:18:30.619 through Ireland’s hospitals. 00:18:30.660 --> 00:18:32.029 It was pure chaos. 00:18:32.689 --> 00:18:34.589 Of course, the Conti group was messaging 00:18:34.590 --> 00:18:36.649 the hospital saying, [Music] there’s one 00:18:36.750 --> 00:18:39.359 thing that can make this stop; money. 00:18:40.049 --> 00:18:41.410 Just about every hospital in the 00:18:41.410 --> 00:18:43.110 network got a ransomware note saying, 00:18:43.360 --> 00:18:45.019 "we have ransomwared your data. 00:18:45.199 --> 00:18:47.260 If you want to contact us and negotiate, 00:18:47.279 --> 00:18:49.109 here is the way you do it." The 00:18:49.109 --> 00:18:52.209 hackers demanded $20 million to bring 00:18:52.220 --> 00:18:54.420 back up the hospitals’ computers. 00:18:54.970 --> 00:18:56.820 To make matters worse, the Conti gang 00:18:56.820 --> 00:18:59.929 said they had stolen over 700 gigabytes 00:18:59.949 --> 00:19:02.979 of data like patient and payroll records. 00:19:03.159 --> 00:19:04.619 They were saying, if you want us 00:19:04.619 --> 00:19:06.380 to delete it, you have to pay. 00:19:07.320 --> 00:19:09.669 Now imagine you're the one in the 00:19:09.669 --> 00:19:11.830 Ireland health department that has 00:19:11.839 --> 00:19:14.099 to make the call on what to do next. 00:19:14.500 --> 00:19:16.739 You came into work and you found every 00:19:16.739 --> 00:19:18.200 screen in the building displaying 00:19:18.200 --> 00:19:19.669 the same ransomware message. 00:19:19.889 --> 00:19:21.639 Everyone’s files are encrypted. 00:19:21.650 --> 00:19:22.999 All the computers are down. 00:19:23.169 --> 00:19:24.359 Your backups are gone. 00:19:24.570 --> 00:19:26.119 People’s lives are literally 00:19:26.129 --> 00:19:27.929 on the line, and at the bottom, 00:19:28.110 --> 00:19:30.399 a countdown and a price. 00:19:31.339 --> 00:19:32.589 Ireland’s response? 00:19:32.909 --> 00:19:34.449 GEOFF: No, we are not gonna pay a ransom. 00:19:34.669 --> 00:19:35.269 Forget it. 00:19:35.279 --> 00:19:37.550 JACK: [Music] The executives for 00:19:37.550 --> 00:19:39.289 the Irish health service kept in 00:19:39.290 --> 00:19:40.919 contact with the Conti gang, though. 00:19:41.189 --> 00:19:41.829 I think they were 00:19:41.829 --> 00:19:43.170 negotiating the price down. 00:19:43.570 --> 00:19:44.679 But I also think they were just 00:19:44.689 --> 00:19:46.259 trying to buy some time so that 00:19:46.259 --> 00:19:47.549 they don't publish the data yet. 00:19:47.909 --> 00:19:49.000 There was some back and forth 00:19:49.000 --> 00:19:50.389 between the two of them while 00:19:50.389 --> 00:19:51.829 the Ireland health system tried 00:19:51.829 --> 00:19:53.139 desperately to get their systems 00:19:53.139 --> 00:19:55.349 back up and running all on their own. 00:19:56.089 --> 00:19:56.649 GEOFF: They’re desperately trying 00:19:56.649 --> 00:19:59.229 to work out how can we decrypt this 00:19:59.229 --> 00:20:00.579 data without paying the ransom? 00:20:00.580 --> 00:20:01.359 How could we get hospitals 00:20:01.360 --> 00:20:02.189 back on their feet? 00:20:02.360 --> 00:20:03.530 Which are the most important hospitals? 00:20:04.850 --> 00:20:05.259 You're gonna make some 00:20:05.259 --> 00:20:06.299 hard decisions there, Jack. 00:20:06.459 --> 00:20:08.139 You know, is children’s health more 00:20:08.139 --> 00:20:09.299 important than older persons’ health? 00:20:09.690 --> 00:20:11.099 Do you prioritize cancer or do 00:20:11.099 --> 00:20:12.409 you prioritize other diseases? 00:20:12.559 --> 00:20:14.470 These are the kind of decisions 00:20:14.479 --> 00:20:15.079 they're having to make. 00:20:15.079 --> 00:20:16.089 They're literally life-or-death 00:20:16.270 --> 00:20:17.649 decisions about where you 00:20:17.649 --> 00:20:18.899 try and apply the help first. 00:20:19.989 --> 00:20:21.189 There was a calculation apparently 00:20:21.190 --> 00:20:22.799 made at the rate they were able to 00:20:22.800 --> 00:20:24.629 decrypt the data, how long it would 00:20:24.639 --> 00:20:26.430 have taken to decrypt all of it without 00:20:26.430 --> 00:20:28.170 the ransomware key, the decryption 00:20:28.179 --> 00:20:30.969 key, and it was in years, one or 00:20:30.969 --> 00:20:32.839 two years, to unscramble it all. 00:20:33.009 --> 00:20:34.970 So, you're facing these problems month 00:20:35.069 --> 00:20:36.859 after month, potentially year after year. 00:20:37.599 --> 00:20:39.010 So, the hackers kept going. 00:20:39.010 --> 00:20:40.609 Of course, at this point, frankly, 00:20:40.610 --> 00:20:41.819 you may as well — you scramble all 00:20:41.819 --> 00:20:43.479 the data; you're kind of in for a 00:20:43.479 --> 00:20:44.719 penny, in for a pound, or in for 00:20:44.889 --> 00:20:46.249 several tens of millions, in this case. 00:20:49.369 --> 00:20:52.600 There was a period of several weeks 00:20:52.600 --> 00:20:53.790 where all of this was going on. 00:20:53.790 --> 00:20:54.790 The data was scrambled, 00:20:55.160 --> 00:20:56.340 hospitals were really struggling. 00:20:56.820 --> 00:20:57.830 The hospitals were getting by. 00:20:58.559 --> 00:21:00.649 The health professionals, they can 00:21:00.650 --> 00:21:02.289 get back some test results, but it’s a 00:21:02.289 --> 00:21:04.509 fraction of what they get, and they can 00:21:04.510 --> 00:21:05.820 continue treatment with some people. 00:21:06.070 --> 00:21:07.529 JACK: But after weeks, the hacker 00:21:07.529 --> 00:21:09.329 had a surprising change of heart. 00:21:09.580 --> 00:21:11.470 Out of nowhere, without having paid 00:21:11.470 --> 00:21:13.970 the ransom, they gave the decryption 00:21:13.980 --> 00:21:16.960 key over to Ireland, and seemingly just 00:21:16.960 --> 00:21:18.460 left the hospital alone after that. 00:21:18.980 --> 00:21:20.680 It’s still a mystery as to why, but 00:21:20.680 --> 00:21:22.110 there are some running theories. 00:21:22.149 --> 00:21:23.470 One theory is that there’s a 00:21:23.470 --> 00:21:25.609 Russian embassy in Ireland, and it 00:21:25.669 --> 00:21:27.800 condemned the attack, even agreeing 00:21:27.820 --> 00:21:29.499 to support Ireland as it recovered. 00:21:30.000 --> 00:21:31.129 So, the hackers handed over the 00:21:31.180 --> 00:21:32.929 decryption key so hospitals could 00:21:32.930 --> 00:21:34.709 recover, but their attacks continued 00:21:34.779 --> 00:21:36.730 against other places in Ireland. 00:21:37.279 --> 00:21:38.939 They infected school districts, 00:21:39.070 --> 00:21:40.959 city government, and businesses. 00:21:41.180 --> 00:21:43.849 Their demands were always the same; pay 00:21:43.849 --> 00:21:45.790 up to decrypt your computers or else 00:21:45.790 --> 00:21:47.810 we release your data on the dark web. 00:21:48.149 --> 00:21:50.009 CONTI: Just in case, if you try to ignore 00:21:50.010 --> 00:21:52.299 us, we’ve downloaded your data and are 00:21:52.329 --> 00:21:54.679 ready to publish it if you do not respond. 00:21:55.129 --> 00:21:56.969 So, it will be better for both sides 00:21:57.019 --> 00:21:59.469 if you contact us as soon as possible. 00:21:59.469 --> 00:22:01.849 JACK: [Music] One of their targets in 2021 00:22:01.909 --> 00:22:04.749 was this jewellery company called Graff. 00:22:06.250 --> 00:22:08.040 It’s in the UK and known as 00:22:08.040 --> 00:22:09.579 the jeweller of the stars. 00:22:09.900 --> 00:22:11.899 Its clients include Donald Trump, 00:22:11.970 --> 00:22:13.670 Oprah Winfrey, and David Beckham. 00:22:14.089 --> 00:22:15.850 But the client list is never 00:22:15.919 --> 00:22:17.649 revealed publicly by Graff. 00:22:17.790 --> 00:22:19.069 It’s actually super secret. 00:22:19.079 --> 00:22:20.379 They are extremely tight-lipped 00:22:20.379 --> 00:22:21.580 about who their clients are. 00:22:22.129 --> 00:22:24.959 But in 2021 Conti broke into the 00:22:24.959 --> 00:22:27.180 jewellery store digitally and stole 00:22:27.229 --> 00:22:29.749 a list of all of Graff’s clients. 00:22:30.189 --> 00:22:32.659 This, of course, made Graff panic, 00:22:32.779 --> 00:22:34.539 and they were extremely upset. 00:22:34.930 --> 00:22:37.340 The names and phone numbers of all their 00:22:37.340 --> 00:22:39.779 high-end customers has been stolen and 00:22:39.779 --> 00:22:40.679 in the hands of some cybercriminals? 00:22:41.999 --> 00:22:42.679 Forget about the 00:22:42.680 --> 00:22:43.800 computers being encrypted. 00:22:43.800 --> 00:22:45.779 The stolen data was more of a problem now. 00:22:46.189 --> 00:22:47.859 Conti wasn't messing around. 00:22:48.059 --> 00:22:49.680 When Graff didn't pay right away, 00:22:49.939 --> 00:22:51.090 they wanted to show them they were 00:22:51.090 --> 00:22:52.939 serious, so they took a chunk of 00:22:52.939 --> 00:22:54.829 this customer data and released it. 00:22:54.929 --> 00:22:58.809 70,000 Graff documents hit the dark web. 00:22:59.149 --> 00:23:00.569 GEOFF: The solution to ransomware was 00:23:00.569 --> 00:23:02.779 pretty easy; back up your data, 'cause 00:23:02.779 --> 00:23:04.429 if it’s scrambled, you can just wipe 00:23:04.449 --> 00:23:05.870 the computer, reinstall the data from 00:23:05.870 --> 00:23:08.020 backup, and jog on and not pay the ransom. 00:23:08.599 --> 00:23:10.870 Of course the ransomware gangs saw that, 00:23:11.190 --> 00:23:12.729 saw it’s a threat to their business, 00:23:12.739 --> 00:23:15.279 which it was, and invented the idea of 00:23:15.279 --> 00:23:16.260 what they called double-dip ransomware. 00:23:17.410 --> 00:23:17.889 JACK: Double-dip ransomware, 00:23:18.809 --> 00:23:20.529 essentially a cyber attack with two 00:23:20.529 --> 00:23:22.359 steps; steal sensitive corporate 00:23:22.369 --> 00:23:24.229 data before encrypting it. 00:23:24.479 --> 00:23:25.969 It gives the hackers more leverage. 00:23:26.319 --> 00:23:28.399 Conti demanded the jeweller pay tens 00:23:28.419 --> 00:23:30.570 of millions of dollars to decrypt its 00:23:30.570 --> 00:23:33.099 systems and to prevent more information 00:23:33.330 --> 00:23:34.639 from getting out on the dark web. 00:23:34.979 --> 00:23:36.130 GEOFF: So, instead of just scrambling 00:23:36.130 --> 00:23:38.259 the data, we will steal a chunk of 00:23:38.259 --> 00:23:40.769 the data and then scramble the data. 00:23:41.109 --> 00:23:42.770 If the victim refuses to pay because 00:23:42.770 --> 00:23:43.979 they’ve got backups of their data, 00:23:44.159 --> 00:23:46.330 we can say, ha-ha, if you don't pay, 00:23:46.330 --> 00:23:47.980 we will leak this sensitive data. 00:23:48.700 --> 00:23:50.170 It’s exactly what happened to Graff. 00:23:50.980 --> 00:23:54.079 So, with Conti, it wasn't the full leak. 00:23:54.090 --> 00:23:56.199 It would have been a few hundred 00:23:56.200 --> 00:23:58.259 pages, maybe, of data, but in 00:23:58.259 --> 00:23:59.200 there would have been the data 00:23:59.360 --> 00:24:01.009 of very high-profile clients. 00:24:01.430 --> 00:24:03.380 My guess is that Conti scanned 00:24:03.389 --> 00:24:04.480 the information and thought, oh, 00:24:04.480 --> 00:24:05.740 look, some famous people here. 00:24:06.219 --> 00:24:08.569 We’ll stick this online as a sort of 00:24:08.570 --> 00:24:10.280 threat to the Graff group and say, 00:24:10.280 --> 00:24:11.520 look, if you don't pay the ransom, 00:24:11.680 --> 00:24:12.889 there’s gonna be more of this. 00:24:13.230 --> 00:24:15.970 But Conti didn't look really carefully 00:24:15.990 --> 00:24:17.110 through the data they were leaking. 00:24:17.590 --> 00:24:18.720 JACK: There was actually too much data 00:24:18.720 --> 00:24:20.500 for the Conti gang to analyze effectively. 00:24:20.590 --> 00:24:23.010 In the end, Graff did pay up. 00:24:23.340 --> 00:24:26.219 They paid $7.5 million in Bitcoin. 00:24:26.829 --> 00:24:28.779 They didn't want the rest of their client 00:24:28.779 --> 00:24:30.039 list getting out, and they felt like 00:24:30.039 --> 00:24:31.799 this was the price they have to pay to 00:24:31.809 --> 00:24:33.629 keep their customers’ records secret. 00:24:34.360 --> 00:24:35.849 But how much can you even trust this 00:24:35.879 --> 00:24:37.649 Conti group to be good on their word 00:24:37.660 --> 00:24:39.559 when they say they’ll actually delete it? 00:24:40.090 --> 00:24:41.959 It must have been so maddening for Graff. 00:24:42.639 --> 00:24:44.419 But Conti’s successful jewellery heist 00:24:44.649 --> 00:24:47.049 may have been rushed, even sloppy. 00:24:47.609 --> 00:24:48.720 We all make mistakes when we're 00:24:48.720 --> 00:24:50.609 rushing, and Conti is no different. 00:24:50.979 --> 00:24:52.749 Within the initial breach of customer 00:24:52.750 --> 00:24:54.950 data leaked on the dark web, Conti 00:24:55.209 --> 00:24:58.239 unwittingly shared details of purchases 00:24:58.610 --> 00:25:02.459 of high-profile members of society, and 00:25:02.470 --> 00:25:05.419 one of those was the Saudi royal family. 00:25:06.080 --> 00:25:08.549 That’s right, Conti doxxed 00:25:08.849 --> 00:25:10.829 the Saudi royal family. 00:25:13.219 --> 00:25:15.559 GEOFF: [Music] And that did 00:25:15.559 --> 00:25:16.969 not go down well, it seems, 00:25:17.009 --> 00:25:18.429 among the Saudi royal family. 00:25:18.430 --> 00:25:19.870 There are people around the world who 00:25:19.889 --> 00:25:21.379 you want to offend and people who you 00:25:21.379 --> 00:25:23.290 really, really don't, and the Saudis are 00:25:23.329 --> 00:25:25.629 probably very much the latter category. 00:25:25.629 --> 00:25:27.529 JACK: After the UK’s Daily Mail reported 00:25:27.529 --> 00:25:29.250 on this heist, the Conti gang must have 00:25:29.259 --> 00:25:31.509 been contacted by someone or threatened 00:25:31.509 --> 00:25:33.509 or something serious happened, because 00:25:33.959 --> 00:25:36.770 Conti published an apology, something 00:25:36.770 --> 00:25:37.800 you never see from cybercriminals. 00:25:38.990 --> 00:25:40.550 CONTI: We found that our sample 00:25:40.579 --> 00:25:42.459 data was not properly reviewed 00:25:42.489 --> 00:25:44.380 before being uploaded to the blog. 00:25:45.099 --> 00:25:47.059 Conti guarantees that any information 00:25:47.059 --> 00:25:48.779 pertaining to the members of Saudi 00:25:48.779 --> 00:25:52.089 Arabia, UAE, and Qatar families will be 00:25:52.089 --> 00:25:54.499 deleted without any exposure and review. 00:25:54.889 --> 00:25:57.010 Our team apologizes to his royal 00:25:57.010 --> 00:25:59.049 highness Prince Mohammed bin Salman, 00:25:59.869 --> 00:26:01.650 and any other members of the royal 00:26:01.650 --> 00:26:03.820 family whose names were mentioned in 00:26:03.820 --> 00:26:06.239 the publication for any inconvenience. 00:26:06.860 --> 00:26:07.989 JACK: Conti said it removed the 00:26:07.989 --> 00:26:09.830 documents from Graff that had initially 00:26:09.830 --> 00:26:11.540 leaked online and claimed none of the 00:26:11.540 --> 00:26:13.569 stolen data was sold on auctions or 00:26:13.569 --> 00:26:15.719 offered as samples or revealed in any 00:26:15.720 --> 00:26:17.360 other capacity to any third party. 00:26:17.809 --> 00:26:18.969 CONTI: Conti guarantees to 00:26:19.000 --> 00:26:21.080 implement a more rigid data-review 00:26:21.129 --> 00:26:23.719 process for any future operations. 00:26:24.809 --> 00:26:27.359 JACK: Wow, that’s really unusual 00:26:27.369 --> 00:26:29.860 that they retracted their leak. 00:26:30.539 --> 00:26:33.429 My head starts to go to, okay, somebody 00:26:33.459 --> 00:26:35.720 was — somebody had enough wealth and 00:26:35.720 --> 00:26:37.130 influence to be able to say, okay, 00:26:37.130 --> 00:26:38.609 let’s find out who these people were 00:26:38.860 --> 00:26:40.589 and go and personally threaten them. 00:26:40.729 --> 00:26:41.809 GEOFF: Yes, yes. 00:26:41.809 --> 00:26:44.720 There was an expert we interviewed for 00:26:44.720 --> 00:26:47.100 the podcast, a intelligence expert. 00:26:47.490 --> 00:26:51.090 His assessment of this was that the kinds 00:26:51.099 --> 00:26:52.669 of wealth you're talking about and the 00:26:52.670 --> 00:26:54.789 kinds of people involved in those leaks 00:26:54.790 --> 00:26:56.900 — you're talking about the top strata of 00:26:56.910 --> 00:26:58.760 the world’s richest, most powerful people. 00:26:59.600 --> 00:27:01.729 They have a cadre of people around 00:27:01.730 --> 00:27:03.520 them who look after their security 00:27:03.520 --> 00:27:04.829 and look after their interests. 00:27:06.389 --> 00:27:10.149 Those people are very good at their jobs 00:27:10.439 --> 00:27:11.889 and will make it absolutely clear to 00:27:11.889 --> 00:27:14.190 a gang like Conti; you have done this. 00:27:14.240 --> 00:27:15.030 There are going to be 00:27:15.030 --> 00:27:16.320 consequences for you. 00:27:16.509 --> 00:27:18.570 We have ways of finding you, and if we 00:27:18.570 --> 00:27:20.409 find you, you're in a lot of trouble 00:27:20.430 --> 00:27:22.190 and potentially a lot of danger. 00:27:22.669 --> 00:27:23.259 So, there would have been an 00:27:23.259 --> 00:27:26.029 intimidation of Conti to say, 00:27:26.119 --> 00:27:27.889 take this data down or else. 00:27:27.919 --> 00:27:30.120 You're not playing here with low players. 00:27:30.120 --> 00:27:32.029 You're playing with serious people. 00:27:32.539 --> 00:27:34.899 Now, as I say, we do not — no, 00:27:34.899 --> 00:27:36.490 we're not privy to those e-mails 00:27:36.490 --> 00:27:37.460 because they would have been sent 00:27:37.469 --> 00:27:39.500 and received by the security teams 00:27:39.500 --> 00:27:40.999 behind these powerful people. 00:27:41.459 --> 00:27:42.189 But as I say, the proof of 00:27:42.189 --> 00:27:43.279 the pudding is in the eating. 00:27:43.289 --> 00:27:45.270 We know that Conti issued an 00:27:45.270 --> 00:27:47.949 apology and we know within internal 00:27:47.949 --> 00:27:49.809 conversations within Conti that 00:27:49.809 --> 00:27:51.450 they absolutely freaked out when 00:27:51.450 --> 00:27:53.919 this happened and were very worried. 00:27:54.259 --> 00:27:55.139 In fact, one of the quotes in 00:27:55.139 --> 00:27:56.429 the Conti gang was, they’ll 00:27:56.430 --> 00:27:57.749 find you and you're gone. 00:27:58.339 --> 00:28:00.809 So, we know that Conti wrote internally. 00:28:00.939 --> 00:28:01.740 We know that publicly 00:28:01.740 --> 00:28:02.890 they were apologizing. 00:28:03.509 --> 00:28:05.310 If you join the dots, it does really 00:28:05.310 --> 00:28:06.539 look like somebody got to Conti 00:28:06.930 --> 00:28:08.760 and said, take it down or else. 00:28:11.550 --> 00:28:12.480 JACK: [Music] Wow, that’s 00:28:12.500 --> 00:28:13.520 really surprising to me. 00:28:13.549 --> 00:28:16.429 I imagine these ransomware groups to be 00:28:16.739 --> 00:28:18.629 always getting threats from people, right? 00:28:18.629 --> 00:28:20.049 Just like, I will find you and I will 00:28:20.709 --> 00:28:22.170 take your children or dog or something. 00:28:22.779 --> 00:28:24.459 They just like watching the world burn. 00:28:24.869 --> 00:28:26.289 So, it’s just a surprise to see 00:28:26.290 --> 00:28:28.749 them be threatened in such a way, be 00:28:28.759 --> 00:28:30.969 scared in some way, that they issue 00:28:30.970 --> 00:28:33.719 an apology and redact their leak. 00:28:34.509 --> 00:28:35.890 They must have been really spooked. 00:28:36.540 --> 00:28:37.799 They were on such a roll, too. 00:28:37.799 --> 00:28:40.809 In 2021 alone, they collected over $180 00:28:40.820 --> 00:28:43.340 million from their ransomware operations. 00:28:44.040 --> 00:28:45.919 But I guess Conti was getting their first 00:28:45.930 --> 00:28:48.279 taste of flying too close to the sun. 00:28:49.139 --> 00:28:50.450 We're gonna take a quick ad break here, 00:28:50.450 --> 00:28:52.119 but stay with us because when we come 00:28:52.129 --> 00:28:53.979 back, these nesting dolls are gonna come 00:28:53.979 --> 00:28:56.329 apart in the most dramatic way possible. 00:29:01.330 --> 00:29:03.470 Imagine this; two Russian hackers 00:29:03.569 --> 00:29:04.600 are having a conversation. 00:29:04.869 --> 00:29:07.489 One of them is planning a major attack 00:29:07.500 --> 00:29:09.100 against, I don't know, a hospital, 00:29:09.110 --> 00:29:11.549 let’s say, and the other is in disguise 00:29:11.809 --> 00:29:14.779 posing as a Russian hacker, and he’s 00:29:14.779 --> 00:29:17.000 really trying to thwart that attack. 00:29:17.389 --> 00:29:18.620 The conversations are happening 00:29:18.620 --> 00:29:19.909 over a dark web forum or 00:29:19.910 --> 00:29:21.709 on Jabber or Rocket.Chat. 00:29:22.279 --> 00:29:23.830 Sure, conversations with a Russian 00:29:23.830 --> 00:29:25.489 hacker might start light, like 00:29:25.500 --> 00:29:27.930 talking about fishing or visiting 00:29:27.930 --> 00:29:29.509 Saint Petersburg’s art museums. 00:29:29.989 --> 00:29:31.739 But then they’ll take a turn, 00:29:31.750 --> 00:29:33.979 shifting to actual criminal secrets. 00:29:34.599 --> 00:29:36.810 Just imagine if you could get a hacker to 00:29:36.819 --> 00:29:39.099 be vulnerable when their guard is down. 00:29:39.099 --> 00:29:41.310 [Music] What kind of intel could you get 00:29:41.390 --> 00:29:43.770 about targets or methodologies for attack? 00:29:44.460 --> 00:29:46.270 Could you turn them away from cybercrime? 00:29:47.379 --> 00:29:48.490 ALEX: We find fascinating 00:29:48.750 --> 00:29:49.760 things on the dark web. 00:29:49.790 --> 00:29:51.029 We engage with the bad guys. 00:29:51.280 --> 00:29:53.240 We get inside of not only their 00:29:53.240 --> 00:29:54.749 systems but inside their heads. 00:29:55.150 --> 00:29:56.309 JACK: This is Alex Holden. 00:29:56.309 --> 00:29:58.070 He’s a Ukrainian cyber-security 00:29:58.070 --> 00:29:59.529 researcher now living in the 00:29:59.529 --> 00:30:00.819 US, and he runs a company called 00:30:00.820 --> 00:30:02.570 Hold Security based in Milwaukee. 00:30:03.000 --> 00:30:04.209 Years ago, him and his team 00:30:04.209 --> 00:30:06.070 of analysts began infiltrating 00:30:06.070 --> 00:30:08.130 members of TrickBot, which would 00:30:08.130 --> 00:30:09.970 go on to get acquired by Conti. 00:30:10.389 --> 00:30:12.499 Alex and his team talked with TrickBot 00:30:12.500 --> 00:30:14.399 members pretending to be black hat 00:30:14.410 --> 00:30:16.580 hackers, trying to gain their trust. 00:30:16.919 --> 00:30:18.130 They weren't buying or selling anything, 00:30:18.130 --> 00:30:19.729 'cause that is illegal, but they were on 00:30:19.730 --> 00:30:22.289 a top-secret mission to make connections. 00:30:22.849 --> 00:30:24.150 That’s what Alex does with 00:30:24.150 --> 00:30:26.150 ransomware gangs, nation-state threat 00:30:26.160 --> 00:30:28.249 actors, or hacktivist movements. 00:30:28.610 --> 00:30:29.840 ALEX: You would be surprised, but 00:30:29.840 --> 00:30:32.459 the bad guys on the dark web, all 00:30:32.459 --> 00:30:34.009 of them need to talk to somebody. 00:30:34.009 --> 00:30:34.769 They need a friend. 00:30:35.410 --> 00:30:38.069 We create this friend environment 00:30:38.680 --> 00:30:41.279 for them to start spilling their 00:30:41.279 --> 00:30:42.459 deepest and darkest secrets. 00:30:42.829 --> 00:30:43.599 JACK: So, they're getting some 00:30:43.599 --> 00:30:45.319 of TrickBot’s deepest and darkest 00:30:45.320 --> 00:30:46.600 secrets through its members. 00:30:46.930 --> 00:30:48.679 They even applied for jobs at TrickBot 00:30:48.680 --> 00:30:49.850 and tried to move up the chain, 00:30:50.110 --> 00:30:51.509 and they developed relationships 00:30:51.510 --> 00:30:52.989 with the members to learn more 00:30:53.239 --> 00:30:54.439 and maybe even turn them good. 00:30:55.239 --> 00:30:58.699 ALEX: We also meddled with some of their 00:30:59.099 --> 00:31:01.629 perceptions, opinions, even building 00:31:01.680 --> 00:31:03.570 paranoia for some of them, saying that 00:31:03.570 --> 00:31:05.549 law enforcement is coming for you. 00:31:05.839 --> 00:31:07.129 JACK: After a while of chumming it up 00:31:07.129 --> 00:31:09.850 with TrickBot, Alex caught a big break. 00:31:10.089 --> 00:31:12.759 ALEX: So, one guy part of TrickBot 00:31:13.149 --> 00:31:14.769 decided to give his girlfriend 00:31:14.799 --> 00:31:17.159 as a present access to TrickBot. 00:31:17.589 --> 00:31:20.159 So, this is not like presents that 00:31:20.159 --> 00:31:21.709 guys give to their girlfriends. 00:31:22.259 --> 00:31:25.279 But he gave access so she can go shopping. 00:31:25.899 --> 00:31:28.069 So, he showed how to find credit 00:31:28.070 --> 00:31:30.269 cards, how to take virtual machines 00:31:30.279 --> 00:31:32.340 and stuff like that, and through 00:31:32.399 --> 00:31:33.949 a folly of errors — because we had 00:31:33.949 --> 00:31:36.269 visibility into her communications. 00:31:36.389 --> 00:31:37.949 She did not believe in encryption 00:31:37.949 --> 00:31:39.420 or good passwords, things like that. 00:31:39.719 --> 00:31:41.719 She basically disclosed all of it. 00:31:41.719 --> 00:31:43.889 So, that was one of the main 00:31:44.299 --> 00:31:45.399 vantage points for a while. 00:31:46.239 --> 00:31:48.459 But over time we start looking at 00:31:48.479 --> 00:31:50.699 this and say, okay, he has access to 00:31:50.699 --> 00:31:53.619 a Jabber server, because this girl was 00:31:53.619 --> 00:31:56.749 given an account and the password was 00:31:59.709 --> 00:31:59.719 123456. 00:31:59.750 --> 00:32:02.100 That’s what the admin gave her. 00:32:02.300 --> 00:32:03.690 But his password just had like 00:32:03.690 --> 00:32:06.080 an "A" at the end, after 123456. 00:32:07.529 --> 00:32:08.689 JACK: Alex’s team whittled their way 00:32:08.690 --> 00:32:11.109 into TrickBot’s infrastructure, scraping 00:32:11.110 --> 00:32:12.799 chat logs and eventually cloning 00:32:12.800 --> 00:32:14.629 the network, and while continuing 00:32:14.629 --> 00:32:15.820 to make connections with some of the 00:32:15.820 --> 00:32:17.789 big players in the TrickBot echelon. 00:32:18.239 --> 00:32:20.489 ALEX: You’ll build friendship with 00:32:20.979 --> 00:32:22.739 some of the people, including Stern. 00:32:23.349 --> 00:32:24.969 JACK: Ah, yes, Stern. 00:32:25.330 --> 00:32:26.099 Remember I told you about 00:32:26.099 --> 00:32:27.399 that guy Bentley before? 00:32:27.500 --> 00:32:28.840 He was the one who ran the Dyre ransomware 00:32:29.669 --> 00:32:31.450 gang and then he started the 25th 00:32:31.450 --> 00:32:34.059 Floor Film Company, and then he started 00:32:34.059 --> 00:32:35.699 the TrickBot ransomware gang, which 00:32:35.709 --> 00:32:37.669 morphed into the Conti ransomware gang? 00:32:38.209 --> 00:32:40.510 Well, when it morphed into Conti, 00:32:40.800 --> 00:32:43.560 he morphed from Bentley to Stern. 00:32:43.890 --> 00:32:44.680 But at the time, we didn't 00:32:44.680 --> 00:32:45.909 know who this Stern guy was. 00:32:45.910 --> 00:32:47.250 We only knew that he was one of the 00:32:47.250 --> 00:32:49.400 nesting dolls at the center of Conti. 00:32:49.660 --> 00:32:50.870 ALEX: At some point Stern wants to 00:32:50.880 --> 00:32:54.720 build his own crypto-mining platform. 00:32:55.920 --> 00:32:56.140 There was conversation, like thirty, 00:32:56.140 --> 00:32:56.200 forty pages of conversation about that. 00:32:56.200 --> 00:32:56.280 But this is 00:33:02.500 --> 00:33:06.320 the idea, is to sway it from 00:33:06.330 --> 00:33:08.520 cybercrime to a social angle. 00:33:08.529 --> 00:33:10.919 JACK: [Music] Trying to limit Stern’s 00:33:10.919 --> 00:33:12.880 damage, there are a lot of moving 00:33:12.880 --> 00:33:15.169 parts here, a lot of sleepless nights 00:33:15.469 --> 00:33:17.129 where Alex and his team was glued 00:33:17.139 --> 00:33:19.170 to chat logs, reading chat forums. 00:33:19.660 --> 00:33:21.489 They watched TrickBot starting in 00:33:21.930 --> 00:33:24.009 2019 and continued as TrickBot got 00:33:24.020 --> 00:33:26.119 acquired by Conti two years later. 00:33:26.520 --> 00:33:27.979 His team obtained hundreds 00:33:28.000 --> 00:33:29.209 of thousands of messages. 00:33:29.639 --> 00:33:31.379 They curated the data, they read through 00:33:31.379 --> 00:33:34.359 it, and published summaries of the data. 00:33:35.049 --> 00:33:36.080 What they saw was a criminal 00:33:36.109 --> 00:33:38.009 enterprise a lot more organized 00:33:38.009 --> 00:33:39.600 than any of them even imagined. 00:33:40.029 --> 00:33:41.689 ALEX: TrickBot was run 00:33:41.689 --> 00:33:43.129 by Stern as a company. 00:33:43.779 --> 00:33:45.779 It was not run as a gang. 00:33:47.719 --> 00:33:49.349 I’m very used to corporate America. 00:33:49.720 --> 00:33:50.849 It doesn't look like that right 00:33:50.919 --> 00:33:53.469 now, but the company that they run, 00:33:53.509 --> 00:33:54.990 they had different departments. 00:33:54.990 --> 00:33:56.739 They had physical offices. 00:33:56.989 --> 00:33:58.589 They had lunches. 00:33:58.589 --> 00:33:59.709 They talked to each other. 00:34:00.759 --> 00:34:04.660 They were sympathetic to employees 00:34:04.660 --> 00:34:06.379 like Alavita, who got in trouble. 00:34:06.389 --> 00:34:08.990 JACK: Alavita is the TrickBot member I 00:34:08.990 --> 00:34:10.749 told you about earlier who was arrested. 00:34:10.959 --> 00:34:12.230 She went by Max, remember? 00:34:12.540 --> 00:34:15.419 ALEX: They even said that they are 00:34:15.729 --> 00:34:19.090 allocating $25 million in the first 00:34:19.189 --> 00:34:23.249 eight months of 2021, I believe, 00:34:23.799 --> 00:34:26.209 to improve their infrastructure. 00:34:26.379 --> 00:34:28.089 Not every company can afford 00:34:28.299 --> 00:34:29.749 that much of expension. 00:34:30.149 --> 00:34:30.769 They did. 00:34:30.929 --> 00:34:33.220 So, it was budgeting. 00:34:33.270 --> 00:34:34.970 It was accounting. 00:34:34.970 --> 00:34:36.129 It was everything. 00:34:36.129 --> 00:34:38.010 JACK: Alex’s team also got insight 00:34:38.010 --> 00:34:39.569 into attacks that were still in the 00:34:39.570 --> 00:34:41.369 planning stages, attacks against 00:34:41.369 --> 00:34:43.639 schools, city governments, and hospitals. 00:34:44.269 --> 00:34:46.350 Here's one Conti member named Target 00:34:46.619 --> 00:34:48.250 writing about going after healthcare. 00:34:48.750 --> 00:34:50.119 TARGET: We got on a video call with them. 00:34:50.580 --> 00:34:52.729 They offered eighteen Bitcoin. 00:34:53.229 --> 00:34:55.370 Their turnover is $30 million. 00:34:55.629 --> 00:34:58.269 Heh, let them pay millions. 00:34:58.399 --> 00:35:00.759 Tomorrow we’ll make a move that’ll 00:35:00.759 --> 00:35:02.439 make the whole leadership go, 00:35:02.559 --> 00:35:04.239 "Please, miss, don't do it". 00:35:04.979 --> 00:35:06.230 They got used to little old 00:35:06.250 --> 00:35:07.729 chats and messages over there. 00:35:08.190 --> 00:35:09.749 Eighteen Bitcoin, heh. 00:35:10.459 --> 00:35:12.829 Tomorrow the whole office will rob them. 00:35:13.559 --> 00:35:14.610 Let them die. 00:35:16.349 --> 00:35:17.859 JACK: Despite this being criminal 00:35:17.860 --> 00:35:19.439 activity, there are still certain 00:35:19.449 --> 00:35:21.820 rules that criminal hackers have. 00:35:22.080 --> 00:35:23.419 Ask enough people in the ransomware 00:35:23.440 --> 00:35:24.580 underground, and you'll hear that 00:35:24.580 --> 00:35:25.779 there are certain targets that are 00:35:25.779 --> 00:35:28.270 just off limits, like hospitals. 00:35:28.769 --> 00:35:30.669 After the Russian hacking group LockBit 00:35:30.750 --> 00:35:32.199 targeted a children’s hospital in 00:35:32.199 --> 00:35:35.350 Canada in 2023, it publicly apologized 00:35:35.379 --> 00:35:36.990 and turned over the decryption key. 00:35:37.120 --> 00:35:38.520 It didn't know it was a hospital. 00:35:39.150 --> 00:35:40.970 In the Conti chat logs, you can see 00:35:41.000 --> 00:35:42.440 internal disagreements about the 00:35:42.480 --> 00:35:44.430 ethics of going after healthcare. 00:35:44.860 --> 00:35:46.790 For example, one Conti member asks 00:35:46.790 --> 00:35:49.240 the Conti boss, Stern, if he signed 00:35:49.240 --> 00:35:50.970 off on encrypting the hospital’s data. 00:35:51.530 --> 00:35:52.519 Stern responds with… 00:35:52.959 --> 00:35:53.830 STERN: I usually don't 00:35:53.830 --> 00:35:54.969 approve encryptions. 00:35:55.389 --> 00:35:56.519 CONTI MEMBER: If you didn't approve it, 00:35:56.600 --> 00:35:58.519 I will hand the decryptor to that clinic. 00:35:59.000 --> 00:36:00.249 We agreed not to touch the 00:36:00.250 --> 00:36:01.749 medical center, remember? 00:36:02.150 --> 00:36:03.290 JACK: This Conti member who was 00:36:03.290 --> 00:36:04.779 pushing back against going after 00:36:04.779 --> 00:36:06.739 hospitals messages Stern complaining 00:36:06.750 --> 00:36:07.719 about their coworker, someone 00:36:07.719 --> 00:36:09.039 who goes by the name Dollar. 00:36:09.489 --> 00:36:10.120 CONTI MEMBER: Let’s get 00:36:10.130 --> 00:36:11.320 Dollar out of the game. 00:36:11.570 --> 00:36:13.249 He’s a total idiot. 00:36:13.249 --> 00:36:14.580 Back then he screwed me over, 00:36:14.709 --> 00:36:16.120 claiming he had an agreement with 00:36:16.129 --> 00:36:18.109 you to mess with the hospital, and 00:36:18.110 --> 00:36:19.960 now he targeted the hospital again. 00:36:20.509 --> 00:36:21.570 That’s disrespectful. 00:36:21.889 --> 00:36:23.689 I told him twice that we don't 00:36:23.700 --> 00:36:24.840 touch the medical sector. 00:36:24.849 --> 00:36:24.909 JACK: [Music] 00:36:27.389 --> 00:36:28.929 At this point Conti’s members and 00:36:28.930 --> 00:36:30.939 affiliates were in the hundreds, and 00:36:30.949 --> 00:36:32.679 as it grew it became more challenging 00:36:32.680 --> 00:36:34.409 to control hacking operations. 00:36:34.680 --> 00:36:35.989 So, it’s no surprise you'd get these 00:36:35.989 --> 00:36:37.980 internal riffs about who to attack. 00:36:38.349 --> 00:36:39.689 To make matters worse, Conti 00:36:39.750 --> 00:36:41.100 was without leadership. 00:36:41.549 --> 00:36:43.289 The boss, Stern, drifted 00:36:43.290 --> 00:36:44.709 away from the chat logs. 00:36:45.169 --> 00:36:47.759 He was just not present very much anymore. 00:36:48.269 --> 00:36:51.119 My theory is that when you start a new and 00:36:51.139 --> 00:36:53.399 upcoming cybercrime group, it’s exciting. 00:36:53.400 --> 00:36:53.879 It’s fun. 00:36:54.089 --> 00:36:55.709 But then when things start turning into 00:36:55.709 --> 00:36:57.689 just handling customer support issues all 00:36:57.689 --> 00:37:00.740 day long, leaders often lose interest. 00:37:01.330 --> 00:37:02.690 One of his deputies, someone 00:37:02.690 --> 00:37:04.279 who went by the name Mingo, got 00:37:04.290 --> 00:37:05.989 growingly frustrated about this. 00:37:06.239 --> 00:37:07.579 MINGO: You constantly give me the 00:37:07.579 --> 00:37:08.979 impression that you don't care. 00:37:09.189 --> 00:37:10.869 You need to be online more often 00:37:10.919 --> 00:37:13.399 and in some situations be a bit 00:37:13.399 --> 00:37:15.430 tougher for disciplinary purposes. 00:37:15.769 --> 00:37:17.459 JACK: Then by January 2022, 00:37:17.470 --> 00:37:18.949 researcher Alex Holden says 00:37:18.959 --> 00:37:21.789 Stern left Conti without a trace. 00:37:22.070 --> 00:37:23.829 The chat logs just show Conti 00:37:23.909 --> 00:37:25.809 falling into chaos after that. 00:37:26.099 --> 00:37:26.669 CONTI MEMBER 2: Listen, 00:37:26.889 --> 00:37:28.079 Stern has gone missing. 00:37:28.559 --> 00:37:29.799 CONTI MEMBER 3: No, he’s not missing. 00:37:29.820 --> 00:37:30.999 He’ll show up soon. 00:37:31.509 --> 00:37:31.999 CONTI MEMBER 2: Everyone’s 00:37:32.000 --> 00:37:32.929 looking for him. 00:37:33.459 --> 00:37:34.399 JACK: With the boss gone, 00:37:34.680 --> 00:37:35.679 people started getting worried 00:37:35.680 --> 00:37:37.119 if anyone was gonna get paid. 00:37:37.469 --> 00:37:39.159 Members weren't quite panicking 00:37:39.159 --> 00:37:40.729 yet, but it felt like the ground 00:37:40.729 --> 00:37:42.499 was becoming unstable within Conti. 00:37:43.069 --> 00:37:45.039 Then to everyone’s surprise, 00:37:45.679 --> 00:37:49.350 a full-blown war erupted. 00:37:49.839 --> 00:37:49.899 REPORTER: [Music] 00:37:52.059 --> 00:37:54.450 It was unprovoked, but this is 00:37:54.450 --> 00:37:56.199 what Russian president Vladimir 00:37:56.220 --> 00:37:58.059 Putin unleashed on Ukraine. 00:37:59.599 --> 00:38:01.319 As the sun came up this morning, 00:38:01.739 --> 00:38:03.380 a missile striking an industrial 00:38:03.380 --> 00:38:04.609 park in Western Ukraine. 00:38:06.580 --> 00:38:08.150 A helicopter assault on an 00:38:08.150 --> 00:38:09.400 airport outside of Kiev. 00:38:09.940 --> 00:38:12.330 Close, intense fighting, and 00:38:12.330 --> 00:38:14.199 there are civilian casualties. 00:38:15.750 --> 00:38:17.189 JACK: [Music] Little did we know that 00:38:17.190 --> 00:38:19.269 Russia invading Ukraine was going 00:38:19.269 --> 00:38:21.519 to send a shock wave through Conti. 00:38:21.889 --> 00:38:22.950 Many of the members 00:38:22.989 --> 00:38:24.309 were glued to the news. 00:38:24.410 --> 00:38:25.049 CONTI MEMBER 4: I hope that 00:38:25.080 --> 00:38:26.949 Kiev will be ours by evening. 00:38:27.319 --> 00:38:28.070 JACK: But not everyone in 00:38:28.070 --> 00:38:29.490 Conti was rooting for Russia. 00:38:29.690 --> 00:38:32.079 Many of Conti members were from Ukraine. 00:38:32.479 --> 00:38:34.299 The war split a lot of families 00:38:34.310 --> 00:38:35.630 because some families were living in 00:38:35.630 --> 00:38:37.310 both Ukraine and Russia, and suddenly 00:38:37.330 --> 00:38:38.920 they were at war with each other. 00:38:39.380 --> 00:38:41.600 The war completely split the Conti 00:38:41.650 --> 00:38:43.510 pack, with some of its operators 00:38:43.520 --> 00:38:45.520 really unhappy about this invasion. 00:38:45.889 --> 00:38:47.590 CONTI MEMBER 5: Friends, brothers, 00:38:48.250 --> 00:38:50.250 are there any Ukrainians besides me? 00:38:50.820 --> 00:38:51.530 Madness. 00:38:51.889 --> 00:38:53.160 Support me, brothers. 00:38:53.650 --> 00:38:54.509 JACK: I mean, I’m just thinking 00:38:54.510 --> 00:38:56.819 about — how can you be thick as thieves 00:38:56.840 --> 00:38:59.040 with someone and go rob the world of 00:38:59.049 --> 00:39:00.850 millions of dollars, doing cybercrime 00:39:00.850 --> 00:39:04.150 together, and then suddenly go to war 00:39:04.629 --> 00:39:06.669 with the very people in your own group? 00:39:07.579 --> 00:39:09.859 Members were torn about what to do. 00:39:10.230 --> 00:39:11.469 CONTI MEMBER 6: Talking to you directly. 00:39:11.700 --> 00:39:13.109 Your posts are painful for 00:39:13.110 --> 00:39:14.369 the members of our team. 00:39:14.689 --> 00:39:16.059 JACK: Emotions and tension started 00:39:16.059 --> 00:39:17.299 flaring up in the group chat. 00:39:17.579 --> 00:39:19.109 Half the Conti gang were saying, 00:39:19.359 --> 00:39:21.060 Kiev by dawn, and the other 00:39:21.060 --> 00:39:23.090 half were saying, slava Ukraine. 00:39:23.489 --> 00:39:25.850 Eventually Conti as an organization 00:39:26.029 --> 00:39:27.900 took a stand, releasing a 00:39:27.900 --> 00:39:29.640 statement for the world to see. 00:39:30.309 --> 00:39:31.479 CONTI: The Conti team is 00:39:31.480 --> 00:39:32.989 officially announcing full 00:39:32.989 --> 00:39:34.939 support of the Russian government. 00:39:35.379 --> 00:39:37.199 If anybody decides to organize a 00:39:37.199 --> 00:39:39.530 cyberattack or any war activities against 00:39:39.570 --> 00:39:42.099 Russia, we are going to use all our 00:39:42.139 --> 00:39:44.819 possible resources to strike back at the 00:39:44.820 --> 00:39:47.150 critical infrastructures of an enemy. 00:39:47.760 --> 00:39:48.759 JACK: When that message showed 00:39:48.769 --> 00:39:50.119 up on computer screens across 00:39:50.119 --> 00:39:52.009 the world, there was someone who 00:39:52.009 --> 00:39:54.479 took this note very seriously. 00:39:55.159 --> 00:39:57.940 He was an IT specialist from Ukraine, 00:39:58.489 --> 00:40:02.009 and this message consumed him with anger. 00:40:02.439 --> 00:40:03.799 CONTI LEAKER: I cannot shoot anything, 00:40:03.879 --> 00:40:06.150 but I can fight with a keyboard and mouse. 00:40:06.519 --> 00:40:07.549 JACK: In an interview at the time, 00:40:07.549 --> 00:40:09.399 he told CNN he was prepared to 00:40:09.409 --> 00:40:12.540 cut deep into Conti where it hurt. 00:40:13.049 --> 00:40:14.860 We had someone voice his responses. 00:40:15.220 --> 00:40:16.279 CONTI LEAKER: It’s my country. 00:40:16.959 --> 00:40:18.859 If the Ukrainian government provides 00:40:18.860 --> 00:40:21.379 me weapons, okay, I’ll go fight. 00:40:22.189 --> 00:40:23.439 But I am better at typing. 00:40:23.449 --> 00:40:23.599 JACK: [Music] 00:40:25.809 --> 00:40:28.230 This Ukrainian IT specialist had a plan. 00:40:28.399 --> 00:40:30.790 He wanted to do a data breach on 00:40:30.790 --> 00:40:32.819 the Conti ransomware gang itself. 00:40:33.159 --> 00:40:34.699 He thought if he could get into their 00:40:34.699 --> 00:40:36.269 internal communications, download 00:40:36.269 --> 00:40:37.479 all their chat logs, see what their 00:40:37.479 --> 00:40:38.979 network consists of, look at their 00:40:38.979 --> 00:40:41.269 member information, he could expose 00:40:41.269 --> 00:40:43.479 them in a very devastating way. 00:40:43.989 --> 00:40:45.749 He started working with Alex 00:40:45.750 --> 00:40:47.339 Holden and others to try to 00:40:47.339 --> 00:40:48.899 obtain the Conti chat logs. 00:40:49.289 --> 00:40:51.280 He was grabbing the chat logs while 00:40:51.309 --> 00:40:53.069 other members of the team were reading 00:40:53.069 --> 00:40:54.629 through them and providing summaries. 00:40:54.989 --> 00:40:56.469 These messages were private 00:40:56.789 --> 00:40:57.859 in the Conti network. 00:40:57.869 --> 00:40:59.669 They were never meant to be released. 00:41:00.179 --> 00:41:01.730 But he was determined to 00:41:01.730 --> 00:41:04.019 expose them, to ruin Conti. 00:41:04.529 --> 00:41:05.829 He came to Alex and told 00:41:05.830 --> 00:41:07.160 him what his plan was. 00:41:07.389 --> 00:41:08.850 ALEX: He talked to me ahead of time. 00:41:10.160 --> 00:41:12.279 We talked about how to 00:41:12.279 --> 00:41:15.600 do this properly, and 00:41:17.890 --> 00:41:19.869 it turned out the way it did. 00:41:21.539 --> 00:41:23.069 I had no control over it. 00:41:23.440 --> 00:41:25.129 I did tell him that he needs to 00:41:25.129 --> 00:41:28.589 think about it, but from a legal 00:41:28.589 --> 00:41:30.129 perspective it was not our data. 00:41:32.380 --> 00:41:35.490 From more perspective, I’m also 00:41:35.490 --> 00:41:38.080 from Ukraine, and I completely 00:41:38.120 --> 00:41:39.890 understand him and his actions. 00:41:40.290 --> 00:41:41.949 You have to understand that in 00:41:41.950 --> 00:41:45.499 the first days of the Russian 00:41:45.509 --> 00:41:47.700 invasion into Ukraine, Conti 00:41:50.750 --> 00:41:52.549 stated that they fully 00:41:52.559 --> 00:41:55.850 support the cause of 00:41:59.389 --> 00:41:59.399 Putin. 00:41:59.410 --> 00:42:02.640 My friend as a Ukrainian, Ukrainian 00:42:02.670 --> 00:42:06.289 citizen, Ukrainian national, felt 00:42:06.459 --> 00:42:10.569 that this is his way not to pick up 00:42:10.610 --> 00:42:14.070 a weapon and defend his homeland, 00:42:14.110 --> 00:42:16.719 but something to do bigger against 00:42:16.719 --> 00:42:20.479 the aggression from Russians. 00:42:20.849 --> 00:42:22.199 JACK: Then about a week after the 00:42:22.200 --> 00:42:24.229 invasion, the Ukrainian analyst had 00:42:24.250 --> 00:42:27.049 infiltrated Conti deep enough and gathered 00:42:27.049 --> 00:42:28.709 enough incriminating data that he thought 00:42:28.709 --> 00:42:30.359 it was time to start leaking the data. 00:42:30.500 --> 00:42:32.339 He created a Twitter account called 00:42:34.430 --> 00:42:35.709 @contileaks, which it’s very ironic 00:42:35.709 --> 00:42:37.639 to breach and expose a company who’s 00:42:37.639 --> 00:42:39.219 in the very business of breaching 00:42:39.219 --> 00:42:40.589 and exposing companies, right? 00:42:41.309 --> 00:42:42.379 [Music] Here’s what the first tweet said. 00:42:43.019 --> 00:42:43.659 CONTI LEAKER: Greetings. 00:42:43.879 --> 00:42:45.809 Here is a friendly heads up that the 00:42:45.949 --> 00:42:48.549 Conti gang has just lost all their shit. 00:42:48.919 --> 00:42:50.509 Please know this is true. 00:42:51.110 --> 00:42:52.219 JACK: Now, there’s been speculation 00:42:52.220 --> 00:42:53.759 from researchers and journalists 00:42:53.759 --> 00:42:55.349 that the leaker may have been a 00:42:55.349 --> 00:42:57.299 disgruntled former Conti member. 00:42:57.720 --> 00:42:58.849 The truth is we aren't exactly 00:42:58.849 --> 00:43:00.129 sure who the leaker is. 00:43:00.639 --> 00:43:02.629 But Alex Holden says he knows. 00:43:02.889 --> 00:43:04.930 He says the Conti leaker is a computer 00:43:04.930 --> 00:43:06.859 specialist who at the time of the leaks 00:43:07.199 --> 00:43:10.039 was a consultant for his company, and 00:43:10.040 --> 00:43:11.680 continues to live in Ukraine today. 00:43:12.379 --> 00:43:14.309 Regardless of who he is, he released 00:43:14.549 --> 00:43:16.619 the holy grail for cyber-security 00:43:16.619 --> 00:43:18.349 analysts, researchers, and journalists 00:43:18.549 --> 00:43:19.839 who were studying this gang. 00:43:20.250 --> 00:43:21.509 CONTI LEAKER: The contents of the first 00:43:21.549 --> 00:43:23.810 dump contain the chat communications 00:43:24.060 --> 00:43:26.369 current as of today and going to the 00:43:26.369 --> 00:43:29.179 past of the Conti ransomware gang. 00:43:30.179 --> 00:43:32.639 We promise it is very interesting. 00:43:33.559 --> 00:43:34.909 There are more dumps coming. 00:43:35.059 --> 00:43:35.859 Stay tuned. 00:43:36.820 --> 00:43:38.339 Thank you for your support. 00:43:38.629 --> 00:43:39.919 Glory to Ukraine. 00:43:41.309 --> 00:43:42.839 JACK: Over several data dumps 00:43:42.879 --> 00:43:44.329 there were tens of thousands 00:43:44.330 --> 00:43:45.799 of internal messages released. 00:43:46.160 --> 00:43:47.730 There were conversations about planning 00:43:47.730 --> 00:43:49.780 attacks, names of members, pictures 00:43:49.780 --> 00:43:51.549 of members, and details about the 00:43:51.550 --> 00:43:53.829 organization structure of Conti, which 00:43:53.830 --> 00:43:56.320 was surprisingly hiding in plain sight. 00:43:56.830 --> 00:43:58.550 But there were also nuggets that were 00:43:58.550 --> 00:44:00.489 meant to strike deep into Conti where it 00:44:00.500 --> 00:44:02.879 hurt, like the cryptocurrency accounts 00:44:02.879 --> 00:44:04.390 used to steal millions of dollars in 00:44:04.390 --> 00:44:06.359 ransomware payments or discussions 00:44:06.360 --> 00:44:08.049 about going after journalists reporting 00:44:08.050 --> 00:44:09.719 on the poisoning of the Russian 00:44:09.720 --> 00:44:11.459 opposition leader, Alexei Navalny. 00:44:11.949 --> 00:44:13.640 Alex Holden says before the logs 00:44:13.640 --> 00:44:15.659 were released, there was information 00:44:15.699 --> 00:44:17.469 excluded for safety reasons. 00:44:17.949 --> 00:44:19.519 But he says nothing was altered. 00:44:19.910 --> 00:44:21.629 ALEX: My goal in cyber-threat 00:44:21.689 --> 00:44:24.009 intelligence is to help victims and 00:44:24.059 --> 00:44:26.359 help victims as effectively as possible. 00:44:26.789 --> 00:44:30.329 So, he did what he did, 00:44:30.380 --> 00:44:32.779 and he changed the world. 00:44:33.390 --> 00:44:35.410 We change the world one victim at a time. 00:44:35.410 --> 00:44:37.430 He did something bigger. 00:44:37.830 --> 00:44:39.880 JACK: Because in this situation, Conti 00:44:39.950 --> 00:44:41.980 was a victim of a data breach, so this 00:44:41.980 --> 00:44:44.159 whole thing is flipped on its ear. 00:44:44.650 --> 00:44:45.770 I don't think we’ve ever seen 00:44:45.770 --> 00:44:47.319 a data breach like this before 00:44:47.670 --> 00:44:49.180 where the hackers got hacked. 00:44:49.570 --> 00:44:50.259 ALEX: I don't think it 00:44:50.260 --> 00:44:51.120 was the right thing to 00:44:54.110 --> 00:44:54.360 do. 00:44:56.480 --> 00:44:58.100 Conti shattered in many different groups, 00:44:58.129 --> 00:45:01.899 and the members became part of many other 00:45:01.899 --> 00:45:05.250 ransomware groups that start multiplying 00:45:05.270 --> 00:45:08.119 the crime, and losing visibility 00:45:08.360 --> 00:45:10.339 actually increased the number of victims. 00:45:10.829 --> 00:45:11.960 JACK: Alex Holden says even though 00:45:11.960 --> 00:45:13.440 he wouldn't have publicly released 00:45:13.450 --> 00:45:15.589 the logs, the disclosure changed 00:45:15.599 --> 00:45:18.099 the Conti gang in profound ways. 00:45:18.389 --> 00:45:21.140 ALEX: How many TrickBot and Conti 00:45:21.320 --> 00:45:23.449 operatives have been unmasked since? 00:45:23.799 --> 00:45:25.459 How many of them were indicted? 00:45:25.759 --> 00:45:28.730 How many of them are on wanted lists for 00:45:28.730 --> 00:45:30.729 us, from a law enforcement perspective? 00:45:31.949 --> 00:45:34.430 JACK: [Music] I remember 00:45:34.430 --> 00:45:35.279 when these leaks came out. 00:45:35.330 --> 00:45:36.849 It was quite a moment if you 00:45:36.849 --> 00:45:37.899 were on Twitter at the time. 00:45:38.089 --> 00:45:39.160 We all got our popcorn out 00:45:39.160 --> 00:45:40.169 and we were just watching this 00:45:40.169 --> 00:45:42.819 cyber-gang unravel in real time. 00:45:43.279 --> 00:45:45.270 The nesting dolls just kept opening 00:45:45.279 --> 00:45:47.999 one after another, and we had no idea 00:45:48.000 --> 00:45:49.679 how many would just keep opening. 00:45:49.680 --> 00:45:50.989 It was just wild to see 00:45:50.989 --> 00:45:51.990 one open after another. 00:45:52.259 --> 00:45:54.319 People were being exposed left and right. 00:45:54.320 --> 00:45:55.359 There were pictures of the 00:45:55.359 --> 00:45:56.439 Conti gang going around. 00:45:56.659 --> 00:45:58.319 Soon there were memes about the members. 00:45:58.549 --> 00:46:00.629 Like, surprisingly, there was a half-dozen 00:46:00.629 --> 00:46:02.359 women who were members of the Conti gang. 00:46:02.680 --> 00:46:04.399 So, you'd see posts like, these are 00:46:04.400 --> 00:46:06.480 the women of the Conti ransomware gang. 00:46:06.989 --> 00:46:08.029 Lots of photos were shown of 00:46:08.029 --> 00:46:09.900 just them driving in cars, eating 00:46:09.900 --> 00:46:12.100 lunches, passports, photos of them. 00:46:12.279 --> 00:46:13.579 Many of them were looking like they 00:46:13.579 --> 00:46:15.499 were part of the world of luxury. 00:46:16.129 --> 00:46:19.040 It felt like the lid of this shadowy, dark 00:46:19.040 --> 00:46:21.209 underworld just blew off in an instant. 00:46:21.680 --> 00:46:23.089 It was such a rare glimpse 00:46:23.119 --> 00:46:24.419 into one of the most successful 00:46:24.419 --> 00:46:25.760 ransomware groups of all time. 00:46:26.459 --> 00:46:28.079 Twitter was having a field day. 00:46:28.339 --> 00:46:30.059 This wasn't your typical white paper 00:46:30.079 --> 00:46:31.509 write-up on some ransomware group. 00:46:31.729 --> 00:46:32.769 This had drama. 00:46:32.769 --> 00:46:33.779 This had intrigue. 00:46:34.040 --> 00:46:35.560 This had dirt on scandals. 00:46:36.110 --> 00:46:37.919 I even posted a meme which 00:46:37.919 --> 00:46:40.700 said, ‘Infosec: we know drama’. 00:46:41.649 --> 00:46:42.970 Just reading through the chat logs, 00:46:42.979 --> 00:46:44.450 you see all kinds of infighting. 00:46:44.459 --> 00:46:45.459 You can tell that something 00:46:45.479 --> 00:46:47.129 catastrophic is going to happen soon. 00:46:47.339 --> 00:46:48.349 A lot of us were just sitting 00:46:48.349 --> 00:46:50.069 back in our chairs like, wow, 00:46:50.239 --> 00:46:51.919 Season 1 of this show is amazing. 00:46:52.979 --> 00:46:54.259 Investigative reporter Geoff 00:46:54.259 --> 00:46:55.519 White grabbed a front-row seat. 00:46:55.899 --> 00:46:57.949 GEOFF: When this came out, I think 00:46:58.750 --> 00:46:59.539 there was all this stuff about 00:46:59.539 --> 00:47:01.179 cyberattacks around Ukraine, just 00:47:01.179 --> 00:47:02.399 trying to keep abreast of all of that. 00:47:02.639 --> 00:47:03.989 Then these Conti leaks come out. 00:47:04.269 --> 00:47:06.260 It’s 70,000 messages, Jack. 00:47:06.559 --> 00:47:08.099 It was an absolute nightmare. 00:47:08.099 --> 00:47:09.490 They're all in Russian. 00:47:09.860 --> 00:47:11.209 They're in Cyrillic characters. 00:47:11.580 --> 00:47:13.019 They're in hacker slang, so you 00:47:13.019 --> 00:47:14.649 could try and start translating them. 00:47:15.929 --> 00:47:17.579 Then immediately afterwards you 00:47:17.580 --> 00:47:19.190 get this second huge dump of 00:47:19.190 --> 00:47:20.809 information that’s even more messages. 00:47:20.940 --> 00:47:23.089 JACK: You read 47,000 of these messages? 00:47:23.239 --> 00:47:23.980 GEOFF: Yes, yes. 00:47:23.989 --> 00:47:24.359 Yeah, I did. 00:47:24.589 --> 00:47:25.199 JACK: Amazing. 00:47:25.399 --> 00:47:26.189 GEOFF: The thing about the leaks 00:47:26.190 --> 00:47:27.500 is it’s thousands of messages. 00:47:27.539 --> 00:47:28.840 They're all in Russian. 00:47:28.870 --> 00:47:30.420 They're all in Cyrillic characters. 00:47:30.710 --> 00:47:32.667 Obviously you're thinking — a lot 00:47:32.667 --> 00:47:33.540 of your listeners will be thinking, 00:47:33.540 --> 00:47:35.270 well, stick them in one of these LLMs. 00:47:35.300 --> 00:47:36.850 Let the AI do the work. 00:47:37.349 --> 00:47:38.980 LLMs do not deal well 00:47:38.980 --> 00:47:40.430 with Cyrillic alphabet. 00:47:40.540 --> 00:47:42.199 So, there’s loads of mistranslations. 00:47:43.009 --> 00:47:43.990 So, one of the things they keep talking 00:47:43.990 --> 00:47:45.620 about in their leaks is the cue balls. 00:47:45.670 --> 00:47:46.580 Who’s got the cue balls? 00:47:47.510 --> 00:47:49.410 Like snooker or pool or, you know. 00:47:49.680 --> 00:47:51.468 I couldn't understand this, and then I 00:47:51.468 --> 00:47:52.900 realized that if you take the Russian 00:47:52.920 --> 00:47:55.120 translation of Bitcoin, which is Bitkoin 00:47:55.539 --> 00:47:57.000 — but the N at the end, because it’s in 00:47:57.000 --> 00:47:58.999 Cyrillic, looks a bit like a V. So, 00:47:59.000 --> 00:48:00.530 the translation engines translate it as 00:48:01.299 --> 00:48:03.040 ‘bitkov’, which in Russian is ‘cue ball’. 00:48:03.559 --> 00:48:04.619 Bitkov, cue ball. 00:48:05.309 --> 00:48:05.774 So, whenever they're talking 00:48:05.774 --> 00:48:07.010 about the cue balls, it means 00:48:07.010 --> 00:48:07.949 they're talking about Bitcoin. 00:48:07.959 --> 00:48:09.389 So, immediately you start to 00:48:09.519 --> 00:48:11.209 kind of understand there’s a 00:48:11.230 --> 00:48:13.110 code almost in the translations. 00:48:13.430 --> 00:48:14.219 The other thing they kept talking 00:48:14.219 --> 00:48:17.229 about was the toad, as in the reptile. 00:48:17.419 --> 00:48:19.489 Well, why is the toad slow, and 00:48:19.520 --> 00:48:20.849 I’ve got problems with the toad. 00:48:21.219 --> 00:48:22.569 I couldn't understand why they 00:48:22.570 --> 00:48:23.439 kept talking about the toad. 00:48:23.849 --> 00:48:25.220 It turns out this was — the software 00:48:25.220 --> 00:48:26.490 they were using to communicate was 00:48:26.500 --> 00:48:28.799 Jabber, which in Russian is ‘zhaba’. 00:48:29.579 --> 00:48:30.909 ‘Zhaba’ translates as toad. 00:48:31.609 --> 00:48:33.989 So, they keep talking about the 00:48:34.000 --> 00:48:35.079 toad, and you realize they're talking 00:48:35.080 --> 00:48:36.500 about the Jabber thing being slow. 00:48:36.500 --> 00:48:37.919 [Music] So, as you're reading through 00:48:37.919 --> 00:48:40.719 these messages, you have to go through 00:48:40.720 --> 00:48:42.570 them by eye, I think, one by one, 00:48:42.570 --> 00:48:43.909 because only then you get the hang 00:48:43.909 --> 00:48:45.820 of what is actually being discussed. 00:48:48.750 --> 00:48:51.329 JACK: Okay, so after the leaks came 00:48:51.330 --> 00:48:53.029 out and we start to see the inner 00:48:53.029 --> 00:48:54.720 workings of how this Conti ransomware 00:48:54.720 --> 00:48:57.249 gang is operating, do they skitter? 00:48:57.829 --> 00:48:58.590 Do they run away? 00:48:58.590 --> 00:49:00.199 Do they hide, shut up shop, 00:49:00.209 --> 00:49:01.469 or what happens to them? 00:49:01.949 --> 00:49:02.890 GEOFF: So, in terms of what happened 00:49:02.890 --> 00:49:05.780 next to Conti, we know that the gang 00:49:06.309 --> 00:49:08.770 apparently disbanded, and we know 00:49:08.770 --> 00:49:10.109 that there was talk in the chats 00:49:10.109 --> 00:49:12.549 of, well, it’s coming to an end. 00:49:12.570 --> 00:49:16.339 Just go off and rest for a little while. 00:49:16.339 --> 00:49:17.280 We’ll regroup. 00:49:18.189 --> 00:49:20.390 People who track these things are pretty 00:49:20.409 --> 00:49:22.259 sure that various affiliates with Conti 00:49:22.259 --> 00:49:23.849 just became affiliates for other gangs. 00:49:24.309 --> 00:49:25.989 There’s some suggestion that Conti 00:49:25.989 --> 00:49:28.080 members set up other ransomware groups. 00:49:28.080 --> 00:49:29.559 There’s crossovers with code and so on. 00:49:29.779 --> 00:49:31.839 So, the thing splinters and it fractures. 00:49:32.629 --> 00:49:34.159 But there’s this amazing moment 00:49:34.189 --> 00:49:36.789 where they decide — someone somewhere 00:49:36.789 --> 00:49:38.279 within Conti decides they're gonna 00:49:38.279 --> 00:49:40.809 go for one last big takedown and 00:49:40.809 --> 00:49:41.899 they're just gonna do an absolute 00:49:41.899 --> 00:49:44.079 showstopper, and that’s when they decide 00:49:44.080 --> 00:49:45.649 they're gonna hit an entire country. 00:49:45.649 --> 00:49:46.169 They're gonna hit the 00:49:46.169 --> 00:49:47.199 government of Costa Rica. 00:49:47.550 --> 00:49:49.109 REPORTER 2: Late today we learned that 00:49:49.169 --> 00:49:51.129 Costa Rica has declared a state of 00:49:51.129 --> 00:49:53.690 emergency after a ransomware attack. 00:49:53.690 --> 00:49:54.499 Sounds very… 00:49:56.209 --> 00:49:56.269 REPORTER 3: [spanish] 00:49:56.269 --> 00:49:56.669 SPEAKER 2: I was very terrified for us. 00:50:04.149 --> 00:50:07.109 Over thirty government organizations 00:50:07.179 --> 00:50:09.529 were compromised by that campaign. 00:50:09.579 --> 00:50:10.340 Like, we didn't know what to do. 00:50:12.160 --> 00:50:12.910 REPORTER 2: …and exposed 00:50:13.310 --> 00:50:14.910 citizens’ personal information. 00:50:15.179 --> 00:50:15.989 So, it’s not clear how 00:50:15.989 --> 00:50:16.939 they're gonna resolve… 00:50:16.970 --> 00:50:18.280 JACK: Yeah, Costa Rica declared 00:50:18.280 --> 00:50:19.419 they're at war with Conti. 00:50:19.429 --> 00:50:19.849 How about that? 00:50:20.479 --> 00:50:22.280 Nobody was expecting this as the 00:50:22.289 --> 00:50:23.879 next step from Conti, especially 00:50:23.879 --> 00:50:25.460 after they just got exposed. 00:50:25.979 --> 00:50:27.660 About two dozen different government 00:50:27.670 --> 00:50:29.910 organizations were targeted, and many 00:50:29.910 --> 00:50:31.590 sectors came to a screeching halt. 00:50:31.810 --> 00:50:33.580 This was a big deal for Costa Rica. 00:50:33.850 --> 00:50:35.100 The first thing that was hit 00:50:35.110 --> 00:50:36.540 was Costa Rica’s treasury. 00:50:36.599 --> 00:50:37.800 One of the big ramifications of 00:50:37.809 --> 00:50:39.290 that was importing and exporting of 00:50:39.290 --> 00:50:41.450 goods, and all that’s run digitally. 00:50:41.450 --> 00:50:43.230 So, that just collapsed, and they 00:50:43.230 --> 00:50:44.629 had to go back to pen and paper. 00:50:44.920 --> 00:50:46.779 But Costa Rica was not ready for that. 00:50:46.969 --> 00:50:48.489 A large chunk of the country’s money 00:50:48.490 --> 00:50:50.680 just got cut off because imports, 00:50:50.689 --> 00:50:52.409 exports just grinded to a halt. 00:50:52.799 --> 00:50:53.959 There were also disruptions 00:50:53.959 --> 00:50:55.029 with paying salaries and 00:50:55.029 --> 00:50:56.459 pensions for government workers. 00:50:56.699 --> 00:50:57.653 GEOFF: In the end, the sort of 00:50:57.653 --> 00:50:58.670 solution they came up with was 00:50:59.040 --> 00:51:00.529 anybody who got a pension last month 00:51:00.619 --> 00:51:01.809 gets another pension this month. 00:51:01.809 --> 00:51:03.319 You know, just pay people again 00:51:03.320 --> 00:51:04.719 and hope we sort it out later. 00:51:05.070 --> 00:51:06.329 So, they did manage to get around that. 00:51:06.610 --> 00:51:07.049 JACK: There was also 00:51:07.049 --> 00:51:08.299 political consequences. 00:51:08.299 --> 00:51:10.199 This attack happened right in between a 00:51:10.200 --> 00:51:12.129 change of presidential administrations, 00:51:12.369 --> 00:51:13.690 and it fed into the whole campaign 00:51:13.690 --> 00:51:14.650 against the existing government. 00:51:14.660 --> 00:51:16.299 Like, of course they're incompetent; 00:51:16.309 --> 00:51:17.899 they couldn't stop this cyberattack. 00:51:18.069 --> 00:51:19.839 GEOFF: It sort of fed into this sense of 00:51:20.449 --> 00:51:23.629 a country that was kind of on the edge. 00:51:24.070 --> 00:51:27.270 As the government started looking at this 00:51:27.270 --> 00:51:29.849 and refused to pay Conti, Conti upped 00:51:30.049 --> 00:51:33.089 the ante and attacked more parts of the 00:51:33.089 --> 00:51:34.499 government, more government departments. 00:51:34.500 --> 00:51:35.489 I think the science and technology 00:51:35.489 --> 00:51:36.919 department got attacked, and in the 00:51:36.919 --> 00:51:38.609 end there was various local government 00:51:38.610 --> 00:51:40.100 websites that got taken down. 00:51:40.260 --> 00:51:41.540 As I said, you got this pylon 00:51:41.540 --> 00:51:42.870 effect where other gangs and other 00:51:42.870 --> 00:51:44.949 cyber-criminals started to get involved. 00:51:46.500 --> 00:51:47.389 The Conti government was, in the 00:51:47.389 --> 00:51:49.480 end, fighting fires, and there were 00:51:49.480 --> 00:51:50.670 probably in the dozens of attacks, 00:51:50.680 --> 00:51:52.680 some much bigger like the treasury 00:51:52.680 --> 00:51:54.299 and so on, some much smaller in terms 00:51:54.299 --> 00:51:56.299 of local government institutions. 00:51:56.549 --> 00:51:58.179 But it really was pandemonium. 00:51:58.180 --> 00:51:59.249 It happened at this time the 00:51:59.250 --> 00:52:00.609 transfer in government when Costa 00:52:00.610 --> 00:52:02.589 Rica was particularly vulnerable. 00:52:02.959 --> 00:52:04.339 JACK: The incoming president treated 00:52:04.339 --> 00:52:06.459 this like it was a national emergency, 00:52:06.820 --> 00:52:09.179 and like a wildfire, the vulnerability 00:52:09.189 --> 00:52:11.019 spread across government organizations. 00:52:11.229 --> 00:52:12.760 Some systems were infected through 00:52:12.779 --> 00:52:14.450 phishing e-mails while for others malware 00:52:14.729 --> 00:52:16.169 was just put right on them right from 00:52:16.169 --> 00:52:17.970 the internet, and something became 00:52:17.970 --> 00:52:21.250 clear; maybe this wasn't just Conti. 00:52:21.250 --> 00:52:22.819 GEOFF: As the attack went on, 00:52:23.069 --> 00:52:25.509 other cybercrime groups, other 00:52:25.769 --> 00:52:27.389 ransomware groups emerge and also 00:52:27.619 --> 00:52:28.989 started attacking Costa Rica. 00:52:29.099 --> 00:52:30.869 So, it was kind of a pylon. 00:52:30.879 --> 00:52:33.649 So, Conti were there, definitely, 00:52:33.790 --> 00:52:34.919 but the effects of the Conti 00:52:34.919 --> 00:52:36.759 gang got amplified as the attack 00:52:36.759 --> 00:52:38.310 unfolded over weeks in Costa Rica. 00:52:38.509 --> 00:52:40.239 JACK: Yeah, and I don't know if it 00:52:40.239 --> 00:52:41.500 matters or not, but we don't know 00:52:41.500 --> 00:52:43.339 if it was the Conti ransomware gang 00:52:43.349 --> 00:52:45.289 that actually picked their targets 00:52:45.300 --> 00:52:46.640 or if it was their affiliates that 00:52:46.640 --> 00:52:48.310 picked the targets, or a mix of both. 00:52:49.010 --> 00:52:49.380 GEOFF: Precisely. 00:52:49.390 --> 00:52:51.880 I mean, Conti had so many 00:52:51.880 --> 00:52:53.120 affiliates by this point, 00:52:55.800 --> 00:52:56.739 and those affiliates would of course 00:52:56.739 --> 00:52:59.309 all have had access to the encryption 00:52:59.309 --> 00:53:00.840 software, the ransomware software. 00:53:01.410 --> 00:53:05.030 So, even if the central core Conti group 00:53:05.129 --> 00:53:07.360 dissolved, it strikes me as possible 00:53:07.360 --> 00:53:08.769 certainly technically that somebody could 00:53:08.779 --> 00:53:10.419 have retained that encryption software. 00:53:10.779 --> 00:53:11.790 If they're an affiliate and good at 00:53:11.800 --> 00:53:13.899 getting into a network and infecting 00:53:13.899 --> 00:53:15.549 a network, there’s no reason why 00:53:15.550 --> 00:53:16.709 they couldn't have used the Conti 00:53:17.929 --> 00:53:20.339 ransomware without the core Conti 00:53:20.339 --> 00:53:22.209 gang being aware of it, approving 00:53:22.209 --> 00:53:23.700 it, or even still being in existence. 00:53:23.700 --> 00:53:24.870 This could have been an entirely 00:53:25.420 --> 00:53:27.790 single-affiliate-led job, I think. 00:53:27.800 --> 00:53:28.800 From my technical understanding, 00:53:28.800 --> 00:53:30.090 that’s certainly possible. 00:53:30.450 --> 00:53:32.310 JACK: Another possibility Geoff says 00:53:32.320 --> 00:53:34.270 is that this was a former member of 00:53:34.270 --> 00:53:36.080 Conti that was just flexing their 00:53:36.080 --> 00:53:37.469 muscles, saying, hey, I came from 00:53:37.469 --> 00:53:39.410 Conti and I did the Costa Rica attack. 00:53:39.460 --> 00:53:40.799 Imagine what else I can do. 00:53:41.520 --> 00:53:43.229 We know for sure that Costa Rica got 00:53:43.230 --> 00:53:45.850 hit by Conti ransomware, but that 00:53:45.980 --> 00:53:48.579 was the last incident we ever saw of 00:53:48.580 --> 00:53:50.559 the Conti ransomware, because after 00:53:50.559 --> 00:53:52.069 that, arrests started happening. 00:53:52.570 --> 00:53:54.359 Certain low-level members of Conti 00:53:54.359 --> 00:53:56.070 and TrickBot were getting nabbed. 00:53:56.700 --> 00:53:58.560 Conti seemed to be done. 00:53:59.160 --> 00:54:00.659 Too much had been exposed. 00:54:00.719 --> 00:54:02.889 The war tore the members apart, 00:54:03.230 --> 00:54:04.960 and Stern, their leader, was still 00:54:04.969 --> 00:54:06.510 missing from daily operations. 00:54:07.209 --> 00:54:09.050 But the affiliates that were helping 00:54:09.050 --> 00:54:11.529 spread the Conti ransomware, many of 00:54:11.529 --> 00:54:14.070 them probably just joined other groups. 00:54:14.320 --> 00:54:14.899 GEOFF: There were loads 00:54:14.899 --> 00:54:16.190 of other gangs recruiting. 00:54:16.449 --> 00:54:17.090 If you say, ‘Look, I 00:54:17.090 --> 00:54:18.070 was with the Conti gang. 00:54:18.070 --> 00:54:18.690 I managed to get a couple 00:54:18.690 --> 00:54:20.120 of high-profile targets. 00:54:21.419 --> 00:54:22.389 Can I work with your ransomware 00:54:23.629 --> 00:54:24.999 as an affiliate?’ , you’re 00:54:24.999 --> 00:54:26.079 likely to get a job elsewhere. 00:54:26.480 --> 00:54:29.600 In terms of the core Conti gang, we 00:54:29.600 --> 00:54:31.239 don't know what happened with them. 00:54:31.239 --> 00:54:32.289 The suspicion is they went 00:54:32.290 --> 00:54:33.670 on and formed other groups. 00:54:34.080 --> 00:54:35.179 JACK: The fact is, many of the 00:54:35.179 --> 00:54:36.499 Conti members who appeared in the 00:54:36.500 --> 00:54:38.729 logs, we don't know who they really 00:54:38.729 --> 00:54:39.790 were or what happened to them. 00:54:39.790 --> 00:54:41.169 It’s because a lot of them used 00:54:41.169 --> 00:54:43.139 fake names and were based in Russia, 00:54:43.139 --> 00:54:44.469 so it’s just really hard to trace. 00:54:44.949 --> 00:54:46.360 But one high-ranking person 00:54:46.360 --> 00:54:47.589 within Conti we do know. 00:54:47.820 --> 00:54:49.959 It’s Stern, the TrickBot commander who was 00:54:49.959 --> 00:54:52.329 in charge when Conti absorbed TrickBot. 00:54:53.419 --> 00:54:54.809 German police and international 00:54:54.809 --> 00:54:56.389 prosecutors identified Stern 00:54:56.579 --> 00:54:58.790 as Vitaly Kovalev, a Russian 00:54:58.790 --> 00:55:00.280 national in his late thirties. 00:55:00.860 --> 00:55:03.069 The European Union, UK, and the US all 00:55:03.070 --> 00:55:04.859 sanctioned him, linking him back to 00:55:04.869 --> 00:55:07.379 TrickBot and Conti, a multinational 00:55:07.379 --> 00:55:09.469 response that essentially tries to 00:55:09.470 --> 00:55:11.189 freeze him off from the global economy. 00:55:11.409 --> 00:55:12.559 He’s gonna have a hard time 00:55:12.559 --> 00:55:14.049 using any service that changes 00:55:14.049 --> 00:55:16.249 his money into dollars or euros. 00:55:16.430 --> 00:55:18.629 He likely can't travel to any country that 00:55:18.639 --> 00:55:20.560 has an extradition treaty with the US. 00:55:21.299 --> 00:55:23.699 Vitaly allegedly racked in more than $300 00:55:24.449 --> 00:55:26.969 million in ransomware payments, and that’s 00:55:26.969 --> 00:55:28.869 just his own personal cut of the proceeds. 00:55:29.299 --> 00:55:31.250 But given how long he’s been at it, 00:55:31.649 --> 00:55:33.789 Geoff White says it’s possible that 00:55:33.789 --> 00:55:35.699 he might be a cybercrime billionaire, 00:55:36.119 --> 00:55:37.420 which would be the first person to 00:55:37.420 --> 00:55:39.360 become a billionaire from cybercrime. 00:55:41.229 --> 00:55:42.690 Vitaly isn't someone that you would 00:55:42.759 --> 00:55:44.299 look at and say, oh yeah, that’s a 00:55:44.589 --> 00:55:46.330 successful cybercrime boss right there. 00:55:46.770 --> 00:55:48.029 If you look him up online, you can see 00:55:48.029 --> 00:55:49.939 his face, and he doesn't look suspicious. 00:55:49.940 --> 00:55:51.699 He doesn't have a hood or coverings. 00:55:51.989 --> 00:55:53.199 He’s smiling, looking cheery. 00:55:53.199 --> 00:55:55.019 He’s the kind of person that if you 00:55:55.019 --> 00:55:56.599 were lost on the street, you would stop 00:55:56.599 --> 00:55:58.349 and ask for directions and say hello. 00:55:59.009 --> 00:55:59.979 GEOFF: Frankly, you don't look 00:55:59.979 --> 00:56:01.339 at pictures of Kovalev and think 00:56:01.989 --> 00:56:03.309 internet’s gangster number one. 00:56:05.889 --> 00:56:07.409 Now, I don't know how many other of 00:56:07.919 --> 00:56:09.550 the people you've investigated, Jack, 00:56:09.550 --> 00:56:10.690 who you would think that about, but 00:56:10.690 --> 00:56:12.659 he really just doesn't seem the type, 00:56:12.679 --> 00:56:14.490 which is odd for me to be saying 00:56:14.490 --> 00:56:15.510 as an investigative journalist. 00:56:15.510 --> 00:56:16.386 Normally I would look at people 00:56:16.386 --> 00:56:18.050 and go, yeah, I can see you doing 00:56:18.050 --> 00:56:19.169 this, but Kovalev somehow not. 00:56:20.110 --> 00:56:21.209 Of course, the big problem Vitaly 00:56:21.459 --> 00:56:23.209 Kovalev’s got, if indeed he is 00:56:23.280 --> 00:56:24.910 Stern and did run the Conti gang, 00:56:25.310 --> 00:56:26.799 is what to do with all that money. 00:56:27.440 --> 00:56:28.720 ‘Cause you'll know — again, 00:56:28.720 --> 00:56:29.480 you've done stories in this. 00:56:29.950 --> 00:56:31.580 Bitcoin, if you've made money 00:56:31.580 --> 00:56:32.790 in Bitcoin, you've got a big 00:56:32.809 --> 00:56:34.290 problem in that it’s traceable. 00:56:34.290 --> 00:56:36.130 You know, the big problem I suspect 00:56:36.150 --> 00:56:39.059 now for members of the Conti gang 00:56:39.090 --> 00:56:41.190 is where to launder that money. 00:56:41.190 --> 00:56:44.710 Actually, what we turned up as part of the 00:56:44.920 --> 00:56:48.439 podcast was a sort of whole slew of kind 00:56:48.459 --> 00:56:51.359 of Middle-East based, often Dubai-based 00:56:51.660 --> 00:56:55.079 cryptocurrency-type operations that people 00:56:55.079 --> 00:56:56.720 were saying were linked to or seemed to 00:56:56.730 --> 00:56:59.780 have links to people at the Conti gang 00:56:59.980 --> 00:57:02.470 and some of the individuals behind that. 00:57:04.430 --> 00:57:05.829 Interestingly, sort of around the 00:57:05.829 --> 00:57:07.229 Ukraine war there was kind of a bit 00:57:07.230 --> 00:57:09.349 of an exodus of Russians towards 00:57:09.349 --> 00:57:10.810 Dubai and towards the Middle East. 00:57:11.289 --> 00:57:12.580 JACK: Conti’s rise is both 00:57:12.669 --> 00:57:14.370 astonishing and tragic. 00:57:14.699 --> 00:57:16.179 It became the apex predator 00:57:16.239 --> 00:57:17.329 in the cybercrime world. 00:57:17.750 --> 00:57:19.980 Its tactics evolved, and that turned into 00:57:19.980 --> 00:57:22.380 a cash cow, and it became so big that 00:57:22.380 --> 00:57:24.690 it spawned a network of affiliates who 00:57:24.690 --> 00:57:27.079 went rogue and put targets on its back. 00:57:27.639 --> 00:57:29.770 Conti became so big and famous and 00:57:29.779 --> 00:57:33.049 scary until it became too large to 00:57:33.049 --> 00:57:36.019 last, a victim of its own success. 00:57:40.680 --> 00:57:41.230 Outro: [Outro music] 00:57:45.160 --> 00:57:46.489 Thank you so much to my guests 00:57:46.540 --> 00:57:48.220 Alex Holden and Geoff White. 00:57:48.529 --> 00:57:50.179 Geoff actually has a multi-part 00:57:50.180 --> 00:57:52.259 podcast called The Conti Files by 00:57:52.269 --> 00:57:54.159 Cyber Hack, which goes into so much 00:57:54.159 --> 00:57:55.449 more detail about this Conti story. 00:57:55.459 --> 00:57:56.869 He interviews some really interesting 00:57:56.869 --> 00:57:58.680 people, and it’s worth listening to that. 00:57:59.159 --> 00:58:02.259 Hey, I just released a whole new podcast. 00:58:02.279 --> 00:58:04.419 It’s called LOW, and it is out 00:58:04.449 --> 00:58:05.690 and available for everyone to 00:58:05.690 --> 00:58:07.129 go listen to right now for free. 00:58:07.459 --> 00:58:09.219 Just search your favorite podcast player 00:58:09.220 --> 00:58:13.419 for LOW or go to thisislow.com to find it. 00:58:13.869 --> 00:58:15.329 This is a story that is so 00:58:15.329 --> 00:58:16.460 long and twisted that I felt 00:58:16.479 --> 00:58:17.450 deserved its own podcast. 00:58:18.379 --> 00:58:19.449 It stands on its own as 00:58:19.449 --> 00:58:20.629 something truly special. 00:58:20.939 --> 00:58:21.909 At least I think so. 00:58:22.459 --> 00:58:23.399 The feedback I’ve gotten so 00:58:23.399 --> 00:58:25.489 far is that it is mind-blowing. 00:58:25.769 --> 00:58:27.129 It’ll make you think differently 00:58:27.290 --> 00:58:30.010 about your life, and a lot of people 00:58:30.010 --> 00:58:32.489 say it should absolutely be a movie. 00:58:32.949 --> 00:58:33.940 I’ve never put so much 00:58:33.970 --> 00:58:35.440 effort into a story before. 00:58:35.800 --> 00:58:37.199 It took like seven years for me to 00:58:37.199 --> 00:58:40.080 get this out, so go listen to LOW now. 00:58:40.360 --> 00:58:40.759 Thank you. 00:58:41.559 --> 00:58:42.709 This episode was created by 00:58:42.709 --> 00:58:45.689 me, Sir Loin, Jack Rhysider. 00:58:45.940 --> 00:58:48.229 The ping repeater himself, Sean Powers, 00:58:48.229 --> 00:58:49.440 is who wrote and produced this one. 00:58:49.619 --> 00:58:51.529 Our editor is the ransom werewolf, 00:58:51.580 --> 00:58:53.630 Tristan Ledger, mixing done by Proximity 00:58:53.630 --> 00:58:55.019 Sound, and our intro music is by 00:58:55.019 --> 00:58:56.539 the mysterious Breakmaster Cylinder. 00:58:57.399 --> 00:58:59.139 My ransomware negotiator 00:58:59.139 --> 00:59:00.619 quit on me last week. 00:59:01.119 --> 00:59:03.530 She said the job had too many demands. 00:59:04.349 --> 00:59:06.019 This is Darknet Diaries.