Conti Inc.: Understanding the Internal Discussions of a large
  Ransomware-as-a-Service Operator with Machine Learning
Estelle Ruellan Masarah Paquet-Clouston Sebastian Garcia
Ransomware-as-a-service (RaaS) is increasing the scale and complexity of
ransomware attacks. Understanding the internal operations behind RaaS has been
a challenge due to the illegality of such activities. The recent chat leak of
the Conti RaaS operator, one of the most infamous ransomware operators on the
international scene, offers a key opportunity to better understand the inner
workings of such organizations. This paper analyzes the main topic discussions
in the Conti chat leak using machine learning techniques such as Natural
Language Processing (NLP) and Latent Dirichlet Allocation (LDA), as well as
visualization strategies. Five discussion topics are found: 1) Business, 2)
Technical, 3) Internal tasking/Management, 4) Malware, and 5) Customer
Service/Problem Solving. Moreover, the distribution of topics among Conti
members shows that only 4% of individuals have specialized discussions while
almost all individuals (96%) are all-rounders, meaning that their discussions
revolve around the five topics. The results also indicate that a significant
proportion of Conti discussions are non-tech related. This study thus
highlights that running such large RaaS operations requires a workforce skilled
beyond technical abilities, with individuals involved in various tasks, from
management to customer service or problem solving. The discussion topics also
show that the organization behind the Conti RaaS oper5086933ator shares
similarities with a large firm. We conclude that, although RaaS represents an
example of specialization in the cybercrime industry, only a few members are
specialized in one topic, while the rest runs and coordinates the RaaS
operation.