Conti
Russia-linked ransomware gang whose internal chats leaked in February 2022.
Conti dropped its brand in May 2022, three months after its internal chats leaked over its backing for Russia's invasion of Ukraine; ransomware.live still counted 815 victim claims across all gangs in September 2026.
Last refreshed: 12 October 2026
What did Conti's collapse do to ransomware volumes?
Timeline for Conti
Mentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesBackground
Conti was a ransomware operation with links to Russia. By the FBI's estimate it had hit more than 1,000 victims by January 2022, and they had paid it over $150m. In May 2022 the US State Department offered up to $10m for information on Conti's leaders and up to $5m for information leading to the arrest of its associates.
In April 2022 Conti knocked out Costa Rica's customs and tax systems. The Costa Rican government refused a $10m ransom demand, and Conti published most of the stolen files. Two months earlier, in February 2022, Conti had declared support for Russia's invasion of Ukraine and its internal chats leaked soon after; the brand shut in May.
The leaked chats showed Conti as a loose confederation of affiliates that shared tools and negotiators. When the name disappeared, its members went to Black Basta, Royal and other crews, and the overall number of attacks did not fall.