Wizard Spider

Summary

A Twitter account under the handle @ContiLeaks emerged publicly, posting anti-Russian government messages and expressing emotional solidarity with Ukraine amid the conflict there. The account's profile explicitly declared opposition to the Russian government and featured commentary reflecting personal distress over events affecting Ukraine and its people. The posts appeared shortly after the account's creation, indicating a rapid, protest-driven activation rather than a typical operational disclosure. This online activity is associated with the Wizard Spider threat group context, though the visible content primarily consists of geopolitical commentary and emotional appeals rather than technical indicators or operational details.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late February 2022, a Twitter account identifying itself as "conti leaks" was created under the handle @ContiLeaks, with a registered join date of February 2022. The account's profile displayed a brief statement declaring opposition to the Russian government, accompanied by the message "fuck ru gov," establishing a politically motivated framing for the subsequent disclosures. The account's self-description and initial posts indicated that the operator behind the handle was aligned against the Russian government and sympathetic to Ukraine, providing early context about the motivations likely driving the publication of internal materials. The profile page referenced a single visible post expressing personal anguish over events unfolding in Ukraine, with the author describing a "breaking heart" over developments affecting "dear Ukraine and my people." This emotional framing, combined with the explicit anti-Russian government stance, suggested that the leaker was positioning the disclosures as both a political statement and an act of solidarity with Ukraine during the early phase of the conflict.

The @ContiLeaks account emerged as a channel associated with disclosures concerning the Conti ransomware group, an organization that has been publicly linked to the threat actor tracked as Wizard Spider. The timing of the account's creation coincided with a period when internal Conti communications and operational documents began surfacing publicly, following an apparent compromise of the group's internal infrastructure or insider disclosure. The visible content on the profile page was limited, showing only one post and standard Twitter interface elements such as sign-up prompts for Apple account creation, references to the platform's Terms of Service, Privacy Policy, and Cookie Use, and a notice that trends were unavailable. The brevity of the captured material constrains a fuller reconstruction of the specific leaked documents, the exact volume of data published, the complete timeline of successive dumps, or the technical and operational details contained within the disclosures. Based solely on the evidence present in this source, the precise contents of the leaks, the full chronology of publications, and the downstream investigative or law enforcement actions taken in response cannot be independently confirmed from the captured content alone.

Sources

Sources available to members: 1 source.