Conti gang has made at least $25.5 million since July 2021
Image: The Record
Catalin Cimpanu November 18, 2021

Conti gang has made at least $25.5 million since July 2021

Conti gang has made at least $25.5 million since July 2021

  • Blockchain analysis of 113 Conti ransomware wallets shows the group has made $25.5 million since July this year.
  • Over $6.2 million have been put asside in a "consolidation wallet," researchers from Prodaft and Elliptic said.
  • The Conti gang launched in August 2020 and has become one of the most active ransomware operations today.

The operators of the Conti ransomware have earned at least $25.5 million from attacks and subsequent ransoms carried out since July 2021, Swiss security firm Prodaft said in a report today.

The company said it worked with blockchain analysis firm Elliptic to track more than 500 bitcoin the Conti gang had collected over the past five months in 113 cryptocurrency addresses.

Conti-Elliptic-payments
Image: Prodaft

Prodaft and Elliptic said they identified several transactions that split $6.2 million of the Conti profits and sent them to what they called a “consolidation wallet.”

“In August 2021, 0.07 bitcoin was sent from this cluster to a prominent exchange known to be used by ransomware groups. Aside from this, Conti have not attempted to cash out or exchange any of the bitcoin they have received into this cluster. Blockchain activity indicates that the remaining 123.06 bitcoin is currently held in an unhosted wallet.”

In addition, researchers said they also tracked ransom payments as the Conti gang distributed the profits to its partners. Known as “affiliates,” these are criminal groups who perform intrusions into companies, install the Conti ransomware, and then get a cut from the ransom payment at the end.

“One cluster was identified which has received payments from both Conti and DarkSide, which may indicate that an individual has worked as an affiliate for both of these groups,” the researchers said, confirming other past reports highlighting that some affiliates jump ship from one ransomware program to another when drawn with larger cuts or better encryption tools.

Conti-consolidation
Image: Prodaft

The discovery of the consolidation wallet is good news, as this could be targeted in a future law enforcement action and have authorities seize a large chunk of a gang’s profits, as the DOJ has done this month with one of REvil’s affiliates.

However, Prodaft points out that while the Conti gang itself runs a consolidation wallet, its affiliates do not appear to do so, and they usually launder their profits through shady exchanges, coin swaps, privacy-enhancing wallets like Wasabi, and via Russian-language darknet market Hydra.

First-ever Conti estimates

But the estimated $25.5 million earnings are just that, an estimation, and the Conti gang is believed to have earned much more over this period, and its history, dating back to August 2020.

However, the figure is also the first and only estimation of Conti’s profits made until today.

Research into tracking ransom payments and the threat actor’s wallets has been done before for other gangs, and this type of research has often helped inform authorities about today’s most dangerous groups, which has often led to law enforcement crackdowns.

Past research and profit estimations for other ransomware gangs include:

After the shutdowns of ransomware operations like Avaddon, REvil, Darkside, and BlackMatter, the Conti gang, along with the LockBit group, have become the most active ransomware-as-a-service (RaaS) platforms today, which explains the attention the group is now getting from both security firms and US cybersecurity agenciesโ€”with CISA issuing a security alert about the group’s heightened activity in September.

Catalin Cimpanu is a cybersecurity reporter for The Record. He previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.