Conti

October 6, 2026

AI Summary

5 min read

In February 2022, a Ukrainian IT specialist watched Russian tanks roll across his country's border. He couldn't shoot a gun, but he could type. So he did something unprecedented: he hacked the hackers. He broke into the internal chat servers of Conti, one of the most feared ransomware gangs on earth, and dumped tens of thousands of their private messages onto the internet. The curtain that had hidden these cybercriminals for years was yanked away, exposing not just their crimes, but their arguments, their insecurities, and their fear of the Saudi royal family.

The Russian Nesting Dolls

Conti didn't appear from nowhere. It was the latest shell in a series of Russian cybercrime groups that kept stacking on top of each other like nesting dolls. At the center was a crime boss who went by Bentley. After running the Dyer ransomware gang, Bentley needed to launder his profits. His creative solution: a Moscow-based film production company called the 25th Floor Film Company. They produced actual films, including one starring Keanu Reeves called Exposed. Their most ambitious project was a movie about a group of Russian computer hackers called Botnet. The screenwriter, a Hollywood recruit named David Kaplan, didn't realize the very building housing the film company was also where the hackers worked. The characters in the script were based on real people in the gang, including Be

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

Listen to Audio Summary Open in App

Never miss an episode of Darknet Diaries

Get every new episode summarized in your inbox — free, ~5 minutes to read.

No spam. Unsubscribe anytime.

What you'll learn

1 (01:02) **The Silence of a Ransomware Attack** - Jack sets the scene with the visceral, fear-filled moment of seeing a ransomware note, introducing the central subject: the Conti gang.
2 (06:18) **The Origins: From Dyre to Trickbot to Conti** - Investigative journalist Jeff White explains the lineage of the Conti gang, starting with the crime boss "Bentley."
3 (11:08) **Inside the Gang: The Recruitment of "Max"** - The story shifts to an early hire, a Latvian programmer named Max (real name: Ala Vitta), who unknowingly joins a cybercrime enterprise.
4 (18:04) **The Attack on Ireland's Health Service** - Conti launches a devastating attack on Ireland's hospital network during the COVID-19 pandemic, putting them on the world stage.
5 (25:06) **Double-Dip Ransomware and the Graff Heist** - Conti's attack on the jeweler Graff demonstrates their evolution into "double-dip" ransomware, where they steal data before encrypting it.
6 (34:10) **Inside the Nest: Alex Holden's Infiltration** - Cybersecurity researcher Alex Holden reveals how his team infiltrated Trickbot/Conti, posing as fellow hackers to gain their trust.
7 (39:31) **Internal Conflict: The Ethics of Hacking Hospitals** - The chat logs reveal a moral code within Conti, where members argued about the "off-limits" nature of attacking the medical sector.

+ Full timestamped outline available in the app

Show Notes

The word Conti struck fear in IT departments across the world. It's a type of ransomware that you hope to never come across. Like most ransomware gangs, the Conti group fell apart. But what's special about this story is how it fell apart. Because it fell apart in a very public, messy, scandalous way. Featuring investigative journalist Geoff White and cyber threat researcher Alex Holden.

Sponsors

This show is brought to you by Doppel. Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform. doppel.com

This show is sponsored by Maze. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information.

Support for this show comes from ThreatLocker. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet.

View all active sponsors.

Sources

Full list of sources on the show page: https://darknetdiaries.com/episode/180/