The widely known Conti ransomware group has suffered a security breach causing the group’s main server IP address to become exposed. This server was utilized to support their payment systems and recovery websites, often times where victims of the group would go to negotiate ransom demands. The security firm that breached Conti stated “Our team detected a vulnerability in the recovery servers that Conti uses, and leveraged that vulnerability to discover the real IP addresses of the hidden service hosting the group’s recovery website.” In addition to exposing the group’s hosting IP address, the firm was also able to gather a month’s worth of information such as the operating system of the onion server, htpasswd of said server, and hostname details. News of the security breach has sent Conti operators scrambling for new hosting in order to avoid other ransom groups or security firms from compromising their operation further. Additionally, Conti actors were very quick to shut down its affected systems since their previous hosting was out of Ukraine, a location where several threat actors from Cl0p, REvil, and LockerGoga have been arrested by Europol and United States agencies. CTAPT is continuing to monitor these actors and will provide updates accordingly.