back to article Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump

A mystery whistleblower calling himself GangExposed has exposed key figures behind the Conti and Trickbot ransomware crews, publishing a trove of internal files and naming names. The leaks include thousands of chat logs, personal videos, and ransom negotiations tied to some of the most notorious cyber-extortion gangs —believed …

  1. ChrisElvidge Silver badge

    GangExposed

    So why can't our much-vaunted intelligence agencies (GCHQ, DIA etc.) do this?

    1. lglethal Silver badge
      Unhappy

      Re: GangExposed

      Because they only care about the Intelligence Agencies of the other states. Ransomware scum are for the police to deal with (in their much-vaunted estimation)...

      The fact that half of the rasnomware scumbags are just working at arms length from their local intelligence agencies should make them their business, but then that's not how it works, is it?

    2. DS999 Silver badge

      Re: GangExposed

      As the article suggests he may be a disgruntled insider, with the kind of access intelligence agencies don't have.

      Also, our intelligence agencies may have bigger fish to fry than these guys. We can end ransomware anytime we want, we simply lack the will to make paying ransom illegal. If the US and EU did that attacks would drop precipitously inside a year once they found they were no longer making money off their attacks.

      1. ITMA Silver badge
        Devil

        Re: GangExposed

        "We can end ransomware anytime we want, we simply lack the will to make paying ransom illegal"

        In the same way Prohibition worked in the USA (1920-1933) and making lots of drugs "illegal" has driven the drug dealers and cartels out of business...

        Dream on.

      2. Alan Brown Silver badge

        Re: GangExposed

        The moment the ransomware attacks started affecting infrastructure (hospitals, utilities, etc) it became something the intelligence agencies should have started paying VERY close attention to (assuming they havn't already, secrecy is their mantra after all)

      3. I am the liquor

        Re: GangExposed

        Disgruntled insider seems very plausible. Would explain why they're not interested in making themselves known to the US government to collect the $10m bounty.

    3. joypar

      Re: GangExposed

      Because they haven't been able to infiltrate anyone...yet?

    4. stryqx

      Re: GangExposed

      Because SIGINT isn't HUMINT, and SIGINT-heavy agencies really suck at HUMINT.

    5. This post has been deleted by its author

      1. ChoHag Silver badge

        Re: GangExposed

        "maybe even" incompetent. Hah!

        Their incompetence is deeply ingrained into the very fabric of their being and defended to the death lest they allow in to their club people who didn't go to the right schools and don't care to wear a tie. Competence gave up around the turn of the century when it was finally made clear that it didn't matter and wouldn't get paid.

        1. Anonymous Coward
          Anonymous Coward

          FBI Competence

          ... varies depending on the knowledge area and the specific agents.

          I attended a technical seminar presented by three of their agents, who were very sharp, and equipped with good software - they were running vmWARE on their laptops back when vmWARE was a new thing. They demo'd a couple of their "own someone's MS-Windows PC" attacks.

          Their message was, it seemed to me, (a) "We're the Feds, and we can pwn your box any time we want", and, (b) "Patch your boxes so that no-one else pwns them."

      2. Anonymous Coward
        Anonymous Coward

        Bullshit Detected

        The app has been tricking users with fake virus warnings since it was released back in 2013 and is secretly affiliated with Avast.

        How is it that you are the only one who has learned about this so-called secret affiliation between this malware and Avast?

        1. Anonymous Coward
          Anonymous Coward

          Re: Bullshit Detected

          "How is it that you are the only one who has learned about this so-called secret affiliation between this malware and Avast?"

          Scammers are using fake pop-up warnings to earn a commission by being Avast affiliates. This isn't unique to Avast, scammers will expolit earning commissions where they can.

          You can read about it here:

          https://malwaretips.com/blogs/remove-avast-your-pc-is-infected-with-5-viruses/

          >>>

          "1. Scammers Setup Avast Affiliate Links

          The first step for scammers is signing up as an affiliate marketer for Avast security products. This provides them with a special affiliate link that will allow them to earn commissions on any sales driven through it.

          Most major companies like Avast operate affiliate programs to allow partners to earn money by promoting their products. However, cybercriminals exploit these programs by directing traffic through their links in deceptive or fraudulent ways.

          By becoming a Avast affiliate, the scammers ensure they’ll profit every time someone falls for their scam pop-up ads and makes a purchase. Affiliate commissions for popular security suites can be upwards of $60 per sale.

          2. Malicious Ads Mimic Avast and Fake Virus Scans

          Once they have the affiliate links set up, the scammers then create fake Avast security scanner pages to mimic real virus scans. These scam websites are designed to precisely replicate the Avast branding, using copied logos, images, and the signature red and white color scheme.

          The pop-up or malware will initiate a phony scan that invariably detects multiple severe threats on your system. Here is an example of the fake scanning progress"

          <<<

          Avast has a rather tarnished reputation:

          https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-announces-refund-claims-process-avast-customers-impacted-deceptive-privacy-claims

          >>>"

          The FTC alleged in a February 2024 complaint that Avast deceived users by claiming that its software would protect consumers’ privacy by blocking third party tracking, but it failed to adequately inform consumers that it would collect and sell their detailed, re-identifiable browsing data. The FTC alleged Avast sold that data to more than 100 third parties through its subsidiary, Jumpshot.

          As part of a settlement order with the FTC, Avast was required to pay $16.5 million, which will be used to compensate consumers. The order also bans Avast from misrepresenting how it uses the data it collects and from selling or licensing any browsing data from Avast-branded products to third parties for advertising purposes, along with other requirements."

          <<<

      3. Lord Elpuss Silver badge

        Re: GangExposed

        "in contact with a receptive female FBI agent..."

        Why exactly is the agent's gender relevant here?

        1. Lord Elpuss Silver badge

          Re: GangExposed

          All those glorious downvotes (and yes I know one is from my resident stalker) but not a single hint or intimation as to why mentioning - ergo: making it about - gender would be remotely relevant.

          Typical lefty tosh.

          1. Anonymous Coward
            Anonymous Coward

            Re: GangExposed

            It seems to be you that is making an issue about gender. When I read the post I didn't pay any heed to the gender mention and considered it just an additional descriptor, which seems to fit with that posters writing style. Not only did you raise it and make it an issue, you did 2 posts.

            In a rather ironic twist I would say 'the lady doth protest too much, methinks'.

            1. This post has been deleted by its author

            2. Lord Elpuss Silver badge

              Re: GangExposed

              "When I read the post I didn't pay any heed to the gender mention and considered it just an additional descriptor"

              And that, in a nutshell, is the problem.

              "Identity" ideology creeps in; so quietly that it seems normal and innocent, whilst being anything but. Unnecessarily referencing gender (or race, or orientation) carries the implication that outcomes were reached because of the person's gender - as opposed to their skills, experience or hard work. In this case, the way gender is referenced clearly implies that other agents were not able or willing to listen due to their being male, and the reason this one did is because she was female. Which would be wrong and offensive to both genders, but it's definitely what was being implied.

              "...I was finally able to get in contact with a receptive female FBI agent over the phone that took the time to listen..."

              1. Rob

                Re: GangExposed

                I think your hard left liberal views have created a situation that didn't need to be, trying being more centrist :-)

                1. Lord Elpuss Silver badge

                  Re: GangExposed

                  I’m about as right wing as it gets.

              2. An_Old_Dog Silver badge

                Re: GangExposed

                When I read the original post, I wondered why the gender mention was there, and it struck me as somewhat odd, but I didn't draw any conclusions from that.

                Your "identity ideology" explanation reminded me of a (claimed) feminist deconstruction I'd happened to read, of one of the "Die Hard" movies. It talked about the symbolism of this and that. As I read, at each point raised, I thought, "Well, I suppose someone could interpret it that way ..."

                I just didn't/don't have the mental symbolism dictionary the writer of that deconstruction did, or that you do. I think there are a fair number of people like me, to whom "a cigar is just a smoke."

                1. This post has been deleted by its author

                2. Lord Elpuss Silver badge

                  Re: GangExposed

                  Fair comment.

                  Years ago we were visiting my in-laws. The conversation turned to home improvements, and my wife’s mother mentioned “oh, our friend Michael; he’s black, installed our kitchen for us.”.

                  My mother in law was a lovely lady and would never be openly racist; however I remember that comment to this day as… ‘odd’. Was she implying that the work was somehow better, or worse, because he was black? Was it a subtle way of letting me know they had black friends? Or was it just an adjective to add richness to the mental picture, with nothing intended beyond that?

                  I don’t know, and unfortunately will now never know (she died during Covid) but it always stuck with me as memorable.

  2. spold Silver badge
    Alert

    Avoid Moscow and check your windows

    The ones in Russian apartment blocks are of very poor quality and people frequently fall out of them....

    1. PB90210 Silver badge

      Re: Avoid Moscow and check your windows

      I once came across an NHS site that listed 'never events', medical incidents that should never have accrued. Alongside the 'normal' ones like wrong limbs operated on, wrong injections and the like, were a couple of 'fallen from window' events!

      Luckily it appears not to have reached the epidemic levels found in Moscow's hospitals and care homes, and hopefully this isn't another symptom of misplaced cutbacks of vital services in the NHS

      1. FirstTangoInParis Silver badge

        Re: Avoid Moscow and check your windows

        On the subject of 'never events' I've known someone be discharged from hospital still wearing a cannula, twice. I wrote to the hospital concerned after that, and at least the staff do check now.

        I've also noticed theatre teams being very careful to mark limbs that need operating on, even though it is otherwise pretty obvious!

  3. Doctor Syntax Silver badge

    "The data we've reviewed provides strong indicators that the source behind the leak is either an ex-member or a disgruntled insider from within the group"

    This could get interesting. Those named, and others not yet named, looking round, wondering who it could be, settling on likely suspects and taking action. In the case of those not yet named, taking preventative action.

    1. Boris the Cockroach Silver badge
      Big Brother

      that there is an SIS tactic, sow discord inside your target group, so that they look at each other wondering who the snitch is, maybe leading one of them to actually start snitching even though your leads and info have all come from intercepted comms...

  4. Tron Silver badge

    quote: law enforcement pursue investigative leads

    At the speed of mud. The crims will just flit the nest for the safety of Moscow. Ideally, special forces would be bringing these guys back in packing crates before you read this article, for a wee chat before losing them in the middle of an ocean. But that won't happen. GCHQ and special forces exist not to protect us from criminals, but to protect politicians from us. From finding out dirt on them and publicising it.

    1. joypar

      Re: quote: law enforcement pursue investigative leads

      Regarding your last two sentences: do you have any evidence of any kind to support those assertions that will stand up to scrutiny? If so then please lay it before us because I for one would be very interested to see it.

      A deafening silence will be just as revealing.

      1. Davidmb

        Re: quote: law enforcement pursue investigative leads

        In the absence of a reply, I’ll chip in with my thoughts.

        For any organisation, you need to look at who provides funding, who provides the rules they operate under, and who appoints the top brass.

        In the case of the aforementioned organisations, the answer to every question is politicians.

        So, it comes down to whether you think politicians are more concerned with the welfare of the general public, or with protecting themselves.

        I personally think that many politicians do care about more than fathering their own nests, but opinions differ.

  5. Anonymous Coward
    Anonymous Coward

    Proof no country wants a really effective police force,

    Because we all know where the real criminals are.

  6. Anonymous Coward
    Devil

    High Stakes

    It's a high stakes bet, worth billions. With a lot of people wanting a piece of the pie.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like