The internal structure of ransomware criminal groups: an analysis of organisational units, functions, roles, and communication patterns within Conti

Ransomware is a significant global cyber threat affecting developed and emerging economies alike. Highly organised ransomware groups are of particular concern, yet little is known about their internal structure. This study examines the organisational structure of the Conti ransomware group, analysing leaked chat logs (n = 168,740). We define and assign roles to key users via a content analysis and conduct a quantitative analysis of directed communication patterns across organisational units and functions. The findings reveal Conti’s corporate-like structure with specialised member tasks. It also finds that leadership and management coordinated extensive communications across units and functions, actively engaging in technical, operational, and human resource domains, while task-oriented departments (technical and operations) displayed strong intra-departmental communication. The paper contributes to scholarship on cybercriminal groups, advancing understanding of how ransomware groups operate and behave, and informing potential disruption strategies.