One of the prominent cybercrime groups – Conti ransomware had its server details exposed by a security firm. They soon published a report on their findings and handed details to law enforcement for legal action.

Leaked details include the server’s IP address and its hashed password. This led Conti ransomware to take the server offline for more than a day, and come back with a notice, explaining the situation.

Leaking a Ransomware’s Identity

Prodaft, a swiss security firm has published a long report detailing their findings regarding the Conti ransomware group. The firm’s researchers have leveraged a bug in one of the servers of Conti ransomware, to leak details regarding their identity.

Also Read- Best Free Anti-Ransomware Tools

The vulnerable server was hosting the gang’s payment portal, through which Conti asks its victims to approach ransom negotiations and decryption keys. Prodaft identified that the server was bearing the IP address of 217.12.204.135, hosted by ITL LLC, a Ukrainian web hosting company.

Aside from the IP address, researchers have monitored the traffic of the server, by maintaining access to it for weeks! While some were identified as victims, some SSH connections depicted Conti members accessing the server at times.

But since the SSH connections belonged only to Tor exit nodes, researchers were unable to find the real identities of Conti members. Yet, they have obtained the hashed password of this server, and the OS it was running on it.

All these findings were published by Prodaft, to which they were soon criticized by the community for letting such details public. Conti ransomware has soon picked up on this and took their server offline. And after 24 hours, they were back up again and posted a note explaining the breach.

While they assured its affiliates not to worry, Prodaft on the other hand shared this information with law enforcement for further legal action.

RECOMMENDED ARTICLESMORE FROM AUTHOR

LEAVE A REPLY

Please enter your comment!
Please enter your name here