Inside the leak: Exploring the structure of the Conti ransomware group

The organisational structures of cybercriminal groups have\r\nattracted significant attention in criminological research, yet\r\nempirical evidence remains limited and inconclusive. This study\r\nbridges this gap by examining the internal dynamics of the Conti\r\ngroup, one of the most prominent ransomware groups in recent\r\nyears. Using network analysis to map structural positions of individuals\r\nwithin the network, combined with qualitative content analysis\r\nof communication messages, this research identifies the roles\r\nplayed by organisational members. The integrated approach\r\nassesses the alignment between network positions and assigned\r\nroles. Leveraging a unique dataset comprising 168,740 leaked chat\r\nmessages, the analysis reveals a hierarchical structure within the\r\ncriminal group, resembling that of legitimate businesses, with\r\ndefined leadership roles and task specialisation. These findings\r\noffer new insights into the organisational frameworks of cybercriminal\r\noperations and the influence of the digital environment on\r\ntheir functioning, contributing valuable knowledge to criminological\r\nresearch and policy formulation.