Conti-Ryuk

Profile narrative

The organisation identified by the alias Conti-Ryuk is a Russia-based cybercriminal actor associated with ransomware and data-extortion activity. It is not described as offering legitimate products or services; its confirmed activity consists of unauthorized access to victim environments, exposure of sensitive data, ransomware-related disruption, and publication of stolen material on leak sites. The confirmed scope in the supplied incident is organizational victimization, specifically a healthcare provider, rather than consumer-focused fraud. The incident also places the actor in a sector where sensitive records have operational, legal, and reputational value, because the published material included patient-specific medical information. The supplied context does not provide a formal membership count, revenue figure, named leadership, or quantified geographic reach beyond the Russia HQ location.

During the 2020-08-02 Ventura Orthopedics incident, Maze operators initially listed the victim on their leak site and uploaded a sample of exfiltrated files. Conti-Ryuk operators then created a separate leak site listing for the same victim and published additional files. Those files included patient names, dates of birth, medications, and diagnostic results. The exposure was made more significant by filenames that revealed protected health information even without opening the file contents. The incident notes that Maze and Conti-Ryuk dumped distinct datasets, while their collaboration in the incident remained unclear. The healthcare provider maintained operational backups, which mitigated broader disruption, and no ransom payment was confirmed. The actor’s distinguishing attributes in the supplied material are its use of leak-site publication, its handling of sensitive healthcare data, and its ability to publish a dataset separate from another ransomware group’s release. No parent organization, subsidiary relationship, or formal ownership structure is stated in the supplied context.

Incidents

1 incident linked to this organisation.