Template-Type: ReDIF-Article 1.0
Author-Name: Claudia-Alecsandra Gabrian
Author-Email: claudia.gabrian@ubbcluj.ro
Author-Workplace-Name: Babeș-Bolyai University
Title: Când atacatorii devin victime: vulnerabilitățile grupărilor de criminalitate cibernetică
Abstract: Ransomware groups represent a category of the cybercriminal landscape, they
operate anonymously, through aliases and underground channels, but since 2022, when
the war between Russia and Ukraine started, the cybercriminal ecosystem has seen some
changes. Information leaks have shown that although these groups seem unstoppable,
on the contrary, they are vulnerable and make mistakes. This article highlights
vulnerabilities of cybercrime groups, based on the leak of internal data from two notable
ransomware groups: Conti and Black Basta. The primary scope is to analyze how the leaks
occurred, what they reveal about the internal operations of cybercriminal activities, and
why such intelligence is highly valuable for cybersecurity research.
Conti was the first ransomware group that supported Russia in the context of the
invasion in Ukraine, the leaks in 2022 revealed internal discussions, strategies, financial
transactions, aliases, organizational structure, etc. After this major event, in 2025,
another ransomware group was involved in a leak, Black Basta, that was highly active in
this field since Conti shut down its activity. The leaks exposed critical operational details,
names, chats, victims, transactions, etc. This article is relevant in this field because it
represents a key topic about cybercrime vulnerabilities.
Conti and Black Basta leaks represent the two most important information
leakage events within groups, and justify that cybercrime groups are also susceptible to
the same exploits they exploit in others. The leaks offer valuable information and a unique
opportunity to analyze cybercrime from the inside, their recruitment, and even internal
conflicts. Knowing the weaknesses of cybercrime groups represents a significant way to
understand how they think and organize their attacks.
Classification-JEL: K42, O33, L86
Keywords: CONTI, BlackBasta, Telegram, leaks, cyber-attacks, ransomware
Journal: Intelligence și cultura de securitate
Pages: 25-40
Volume: 4
Issue: 1
Year: 2025
File-URL: https://www.animv.ro/RePEc/mvn/incsec/ICS_1_2025_4_25-40.pdf
File-Format: Application/pdf
Handle: RePEc:mvn:incsec:v:4:y:2025:i:1:p:25-40