Loading story…
A disgruntled Conti affiliate leaked the gang’s internal training manuals on the XSS cybercrime forum, exposing how affiliates were taught to breach corporate networks, move laterally, escalate privileges, exfiltrate data, and deploy ransomware. The archive reportedly contained 37 text files covering common intrusion tooling such as Cobalt Strike, Rclone, AnyDesk, Metasploit, Ngrok, and NetScan, along with guidance for NTDS dumping, Kerberoasting, SMB brute forcing, and exploitation of Zerologon (CVE-2020-1472) to obtain domain-level access.
The leaks later expanded beyond operational manuals to include source code for two TrickBot components—the Command Dispatcher and Data Collector—as well as the reported doxxing of a Conti developer. Although much of the exposed material reflected known ransomware tradecraft rather than novel techniques, the disclosures provided defenders with rare visibility into Conti’s affiliate operations, tooling, and procedures, helping organizations refine detections and response playbooks against Conti- and TrickBot-linked intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On March 1, 2022, ContiLeaks was reported to have continued leaking internal Conti data by releasing source code for the Trickbot Command Dispatcher and Trickbot Data Collector. The same leak also reportedly doxxed one of Conti's developers, and vx-underground shared a download location for the archive.
A disgruntled member of the Conti ransomware program posted an archive of internal manuals and technical guides on the XSS cybercrime forum after reportedly disputing low payment for breaching corporate networks. The leak exposed 37 text files covering Conti affiliate tradecraft such as lateral movement, privilege escalation, data exfiltration, and ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
threatpost.com
Open sourcetherecord.media
Open sourcesecura.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal chats, playbooks, and malware samples exposed **Conti** as a highly structured ransomware enterprise that combined mature intrusion operations with ongoing development of new attack paths. Reporting on the leaks showed the group maintained specialized teams for coding, testing, administration, reverse engineering, and intrusions, relied on **Trickbot** and **Emotet** infrastructure, and provided affiliates with detailed guidance for enterprise compromise. The leaked playbook documented heavy use of **Cobalt Strike**, **AdFind**, **SharpView**, **SharpChrome**, **SeatBelt**, and **GMER**, along with credential theft, Active Directory reconnaissance, administrator targeting, and exploitation of **`CVE-2020-1472`** to accelerate domain-wide access.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026