Inside the Leak: Exploring the Structure of the Conti Ransomware Group

The organizational structures of cybercriminal groups have attracted significant attention in criminological research. However, empirical evidence on the topic remains scarce and inconclusive. To address this knowledge gap, the present study investigates the internal dynamics of the Conti group, one of the most prominent ransomware groups in recent years, using social network analysis and qualitative content analysis. Leveraging a unique dataset of 168,740 leaked chat messages, our analysis unveils a hierarchical structure within the criminal group that mirrors those found in legitimate businesses, characterized by discernible leadership roles and a clear division of tasks. These results improve our understanding of how cybercrime groups are organized and how the online dimension affects their activities, contributing to both criminological research and policy discussions.