Over the last week, InfoSec Twitter has been set ablaze with #ContiLeaks. An individual, likely of Ukrainian origin or a sympathizer, was outraged by a post from Conti leadership declaring solidarity with Russia. The leaks started with Jabber discussions, a screenshot, and source code dumps. The individual behind the @ContiLeaks twitter account tweeted “Glory for Ukraine!” after four tweets containing the leaks.
These leaks give Cyber Security professionals around the world and specifically Cyber Threat Intel (CTI) analysts insight into the inner workings of the top Ransomware-as-a-Service (RaaS) operator. Our CTI practice has been combing through the data looking for Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) that would support our Managed Detection and Response (MDR) analysts as they hunt in our customer networks. Here are the main lessons our CTI practice has learned over the last several days:
Contrary to the common belief that RaaS gangs are just a bunch of hackers in hoodies, Conti shows the reality that if you are going to participate in this space and be on top, you must have good business operations. The #ContiLeaks have showed us that Conti had a typical business structure. They were made up of roughly 70 employees which included the following departments: Human Resources, Leadership and Management, Research and Development, Reverse Engineers, 3rd Party Contractors, and Penetration Testers. It might surprise some to learn that Conti had proposal requests, a procurement process, and budgetary requirements. When one of the Penetration Testers needed a licensed piece of software, they submitted their request to a Technical Lead. This was then followed by Management with approvals and directions on where the money (cryptocurrency) would be transferred for purchasing. This process was the same for when Research and Development wanted to purchase enterprise security software and hardware for testing their software’s ability to go undetected or for bypassing these security tools.
A lot was already known about the Conti tools, techniques, and procedures (TTPs) however, with the #ContiLeaks more details have emerged that confirmed initial suspicions and information highlighted by researchers such as the DFIR report. This includes how Conti conducted reconnaissance, gained initial access, moved laterally in networks, persisted, and ultimately reached their goal of exfiltration and encrypting their target’s workstations and servers. Much of what was in Conti’s arsenal of tooling came from free and open-source software (FOSS), legitimate versions of Cobalt Strike, Proof of Concept (POC) code for known vulnerabilities found on GitHub, and other community-driven penetration testing projects and scripts; many of which are used by Ethical Penetration Testing practices today. Custom tooling from the group consisted mostly of automation scripts (batch files, obfuscated PowerShell), custom dynamic link libraries (DLLs), portable executables (PEs), and other executables (EXEs) including the Ransomware itself.
It is in this area our CTI practice believes that the true capabilities of Conti reside. As with any small business start-up software company in Europe or the Americas, the employed development team followed modern day development practices. The development team leveraged the Agile method with Continuous Integration (CI) / Continuous Deployment (CD) pipelines. The chatlogs from the #ContiLeaks show they had “sprints” for different projects in development. Conti developers leveraged version control for their different code repositories through a self-hosted GitLab server running on the TOR network. When new projects were completed, fellow employees were directed to pull the latest git repo from GitLab for usage during operations. Furthermore, analysis of the leaked source code shows development by seasoned developers that knew exactly what they wanted to accomplish with their preferred languages (C++, Erlang, JavaScript, and others).
For further details and more in-depth technical information on this topic, please contact us at info@packetwatch.com.