180: Conti

Darknet Diaries traces Conti’s rise from the Dyer and TrickBot gangs to a ransomware empire tied to Vitaly Kovalev (“Stern”) and the front company 25th Floor Film Company. Guests Alex Holden of Hold Security and journalist Jeff White explain how leaks, arrests, and the Ireland and Costa Rica attacks exposed Conti’s operations and the risks of double-extortion ransomware.

Key points

• Conti evolved from Dyer and TrickBot; investigators link it to Vitaly Kovalev, aka Stern/Bentley, and the 25th Floor Film Company.
• Max/Alavita was recruited remotely, then arrested in Miami after investigators traced her Conti role and sloppy opsec.
• Conti’s Ireland attack infected 70,000 computers at 4,000 sites and demanded $20 million; hospitals reverted to pen and paper.
• Conti pioneered double-extortion: encrypt data, steal it first, then threaten public leaks for more leverage.
• Alex Holden infiltrated TrickBot/Conti chat logs, exposing a highly organized criminal business with departments, affiliates, and internal disputes.
• ContiLeaks after Russia invaded Ukraine splintered the gang, but remnants still hit Costa Rica’s government and treasury.