Ransomware Gangs Exposed: Inside the Chats of Conti and Hive

A report from Cisco Talos reveals the tactics used by ransomware gangs to target and negotiate with victims. The study, titled 'Behind the keyboard: Understanding Conti and Hive ransomware operations through their chats with victims,' analyzed over four months of internal chat logs between Conti and Hive group members and their victims.

The report shows that both groups research their targets beforehand, often asking for a ransom equivalent to about 1% of the company's annual revenue. The Conti group uses a structured approach, offering discounts on the ransom payment and promising IT support to prevent future attacks. In contrast, the Hive group takes a more direct approach, sometimes improvising tactics to force victims to pay.

Cisco Talos has several tips for organizations to prevent or combat ransomware attacks, including keeping up with patching, looking for suspicious network traffic, hardening systems, and preventing attackers from using stolen credentials. The report also highlights the importance of multi-factor authentication in protecting against account compromises.