“Someone claiming to work with one of the most notorious ransomware gangs says they’re fed up with how extortion money is divvied up and has leaked a host of the gang’s files on a hacker forum,” reports NBC News:
The files, posted to a forum frequented by Russian-speaking cybercriminals and reviewed by NBC News, include numerous instruction manuals allegedly belonging to Conti, a Russian-speaking hacker group that has attacked several hospitals, including health care chains in the U.S., and Ireland’s national system, the Health Service Executive… The leak appears authentic, said Allan Liska, a ransomware analyst at the cybersecurity company Recorded Future, as it describes the attacks as coming from the same servers that his company already tracked as Conti. Some of the files show IP addresses Conti used for Cobalt Strike attacks, which Recorded Future had seen before…
The leak shows how much of Conti’s operations are apparently contracted out from principal gang members to affiliate hackers, a relationship that can grow sour. “What’s interesting to me about this is how much of it is scripted,” Liska said…
In their post leaking the files, the user, whose role in Conti’s operation has been to find vulnerabilities in potential victims’ networks, complained that those at the top of the gang took too large a percentage of the extortion money. “They recruit suckers and divide the money among themselves,” the user posted in Russian.
Read more of this story at Slashdot.