Când atacatorii devin victime: vulnerabilitățile grupărilor de criminalitate cibernetică

Ransomware groups represent a category of the cybercriminal landscape, they operate anonymously, through aliases and underground channels, but since 2022, when the war between Russia and Ukraine started, the cybercriminal ecosystem has seen some changes. Information leaks have shown that although these groups seem unstoppable, on the contrary, they are vulnerable and make mistakes. This article highlights vulnerabilities of cybercrime groups, based on the leak of internal data from two notable ransomware groups: Conti and Black Basta. The primary scope is to analyze how the leaks occurred, what they reveal about the internal operations of cybercriminal activities, and why such intelligence is highly valuable for cybersecurity research. Conti was the first ransomware group that supported Russia in the context of the invasion in Ukraine, the leaks in 2022 revealed internal discussions, strategies, financial transactions, aliases, organizational structure, etc. After this major event, in 2025, another ransomware group was involved in a leak, Black Basta, that was highly active in this field since Conti shut down its activity. The leaks exposed critical operational details, names, chats, victims, transactions, etc. This article is relevant in this field because it represents a key topic about cybercrime vulnerabilities. Conti and Black Basta leaks represent the two most important information leakage events within groups, and justify that cybercrime groups are also susceptible to the same exploits they exploit in others. The leaks offer valuable information and a unique opportunity to analyze cybercrime from the inside, their recruitment, and even internal conflicts. Knowing the weaknesses of cybercrime groups represents a significant way to understand how they think and organize their attacks.