Inside the leak: Exploring the structure of the Conti ransomware group

The organisational structures of cybercriminal groups have attracted significant attention in criminological research, yet empirical evidence remains limited and inconclusive. This study bridges this gap by examining the internal dynamics of the Conti group, one of the most prominent ransomware groups in recent years. Using network analysis to map structural positions of individuals within the network, combined with qualitative content analysis of communication messages, this research identifies the roles played by organisational members. The integrated approach assesses the alignment between network positions and assigned roles. Leveraging a unique dataset comprising 168, 740 leaked chat messages, the analysis reveals a hierarchical structure within the criminal group, resembling that of legitimate businesses, with defined leadership roles and task specialisation. These findings offer new insights into the organisational frameworks of cybercriminal operations and the influence of the digital environment on their functioning, contributing valuable knowledge to criminological research and policy formulation.