Data

Abstract This chapter outlines the key data sources used to analyze the Conti ransomware group, forming the foundation of the case study. A primary source of insight comes from the leak of internal messages and documents following Russia’s further invasion of Ukraine in February 2022. This unprecedented disclosure provides a rare glimpse into Conti’s internal operations, decision-making processes, and strategic priorities. In addition to the leaked communications, the chapter draws on a range of complementary data sources, including technical intelligence reports, cryptocurrency transaction analysis, government publications, and Conti’s own leak site. These sources collectively offer a multifaceted view of Conti’s activities, allowing for a deeper understanding of its modus operandi, organizational structure, and branding strategies. By detailing these datasets, the chapter highlights both the opportunities and challenges in researching ransomware groups.