The Conti Files: 1. Beaches and Blackmail
Cyber Hack
This episode investigates a devastating ransomware attack on the Redcar and Cleveland Borough Council in February 2020. It details how the C
Key takeaways
- The attack was initiated via a simple phishing email that tricked a council employee into downloading malware.
- The Conti hacking group operates like a structured business, featuring regular payroll and performance bonuses for members.
Main topics
- Ransomware attacks
- Conti hacking group
Notable quotes
The destruction of our systems was total.
Conclusion
A chilling look at how organized cybercrime can destabilize even small
Transcript preview
Speaker 8 (0:00) This BBC podcast is supported by ads Speaker 2 (0:02) outside the UK. Speaker 3 (0:36) I know that my son is somewhere alive. Speaker 4 (0:39) This is Deborah Tice. Her son Austin is one of the biggest missing person cases in the world. And for years, I've been searching for him. It's a case like I never imagined, and there are people who don't want the truth to come out. From the BBC, this is I'm Not A Monster Presents Where Is Austin Tice? Listen on bbc.com or wherever you get your podcasts. Speaker 6 (1:17) Cybercrime. You've read about it in the news, seen the stories on TV. It's probably why you're listening to this podcast. The people behind it are often portrayed as faceless, anonymous monsters from the depths of the internet, causing chaos with a keyboard. Who are these people? What makes them tick? How do they run these destructive cyberattacks? What if we could listen in, actually hear them at work? Speaker 3 (1:52) Well now, we can. My boss is coming now and will start raising prices for you. We asked three million and warned you about the further negotiations. You are sabotaging yourself. Speaker 6 (2:09) They know exactly how to put the squeeze on their victims. Study in detail the info we pull from them and see what's useful there. Everything that could cost them money. And then, go in for the kill. Speaker 6 (2:24) Let them die. Let them pay millions. Let's see what they're going to do. What you're hearing, read by actors, are leaked messages from inside one of the world's most vicious hacking groups. They run it like a business. Speaker 3 (2:42) We have payroll twice a month. The team is very big. Our salaries are stable, so don't get ahead of yourself. After the first year, there is a bonus of 13 months' pay. Some of the guys have even had bonuses of 50k. But their business is Speaker 6 (3:00) extortion. Speaker 6 (3:03) And while their victims suffer, they rake in the profits. Speaker 3 (3:07) How much? 7.5 million. Come on, really? If I'm going to end up in jail, it should be for something truly important and interesting. This is my favourite job. I will never leave for the rest of my life. Speaker 6 (3:25) I'm Geoff White. I'm an investigative journalist covering cybercrime. And what you've been hearing, what you'll hear throughout this podcast, is something I never believed I'd get access to, let alone be able to share with you. It's a giant trove of top secret, internal messages from inside one of the most effective, organised cybercrime operations ever developed. This gang created a blackmail machine and unleashed it across the world, hitting shops, hospitals, schools. Eventually, they'd bring an entire government to its knees. Speaker 6 (4:04) You'll almost certainly have seen headlines about these cyber gangs. Normally, they're penetrating our computers, our systems, our lives. But in this series, we're turning the tables. We're peering into their lives. We've read through tens of thousands of their private messages. We know who they are, how they operate, what makes them tick. Welcome to CyberHack, The Conti Files, a BBC Local production. Speaker 6 (4:35) Episode one, Beaches and Blackmail. The Speaker 2 (4:52) British seaside. There's nowhere quite like it. Donkey rides on the beach, candy floss, the fairground. Redcar is a town of about 40,000 people in the northeast of England. Now, back in the day, this was the place to come for a day out. Speaker 2 (5:22) In summer, the trains arrived packed with holidaymakers, buckets and spades, windbreaks, and kids peering out waiting for the prize, a glimpse of blue sea in the distance and the chance of a chilly swim followed by fish and chips. Then came cheap foreign holidays with guaranteed sun and a long, slow decline for Redcar's tourist trade. Speaker 2 (5:51) But there was still Redcar's other industry, steel, pounded into shape with Promethean might at a steelworks just a few hundred metres back from the beach. But then that went too. Killed off by global economic forces that were way beyond Redcar's control. Life goes on, though, and the town survives. There's still the beach, the parks, fish and chip shops, faded arcades, and a community of people who stayed when the tourists and the steel industry left town. That's where our story starts. Speaker 8 (6:34) Let's keep you up to date now. Andrea McMillan has the latest Speaker 3 (6:37) headlines. The former cork ovens at the Redcastle Works are at risk of inland collapse. Jonathan Woodgate insists he's not concerned by their current run of results. It's Speaker 2 (6:46) a Speaker 3 (6:46) very windy weather to come through the course of the weekend, particularly during the latter half of Saturday. For tomorrow morning, it is going to be mostly dry with some sunny spells, but turning very blustery through the afternoon before rain arrives later in. Speaker 6 (7:01) Friday 7th February 2020. Not a day for the beach. Redcar is Speaker 2 (7:07) braced for a lashing from Storm Chiara. But what no-one yet knows is that a very different storm is also about to break. And this one won't be over in a few days. Speaker 6 (7:20) If you follow the sat-nav to visit the local council offices in Redcar, you'll probably end up at the Civic Centre. It's a glitzy, four-storey, glass-clad building. As well as the council chambers, it's also got a leisure centre. There's a pool, a gym, a sports hall. It's all very she-she. But Redcar and Cleveland Borough Council serves about 140,000 people in the surrounding towns and villages too. So lots of council staff worked in more ordinary offices scattered across the area. Speaker 2 (7:52) 3am on Saturday morning. Storm Chiara is pounding down on Redcar. The council's buildings are closed, but something's happening inside. Speaker 2 (8:02) The gym may be dark, the council chamber empty, but computers never sleep, right? At this moment, the council's machines are wide awake and they're under heavy attack. Speaker 5 (8:14) So my colleague, the network lead, noticed that something was wrong. Speaker 6 (8:19) This is Ben Saunders. He worked in the IT department at the time. He's got long curly brown hair and specs and when we speak, he wears the typical techie outfit, jeans and a black hoodie. That weekend in February is etched into his memory and he still seems a bit shell-shocked by it, Speaker 2 (8:37) even now. What his colleague had noticed were problems on the council's computer network. A virus had somehow got in. At this point, he doesn't exactly know what it is, but he knows it's bad and it's spreading. Ben's colleague is desperately trying to get ahead of it. And he's not going to do this in his pyjamas from a laptop. He needs