Anonymous investigator group GangExposed says it has dealt a major blow to the Conti ransomware syndicate by revealing the real identities, operational methods, and international movements of several senior figures. Their investigation relied on leaked communications, travel and financial records, and public documents to link aliases used inside the gang to named individuals and to map the group’s infrastructure and activities.
Among those the report identifies are Vladimir Viktorovich Kvitko (nicknamed “Professor”), a leader known only as “Target,” the negotiator Arkady Valentinovich Bondarenko, and system administrator Andrey Yuryevich Zhuykov (“Defender”). The report also describes a Dubai-based operational hub, Conti’s attacks on hospitals during the COVID-19 period, and the technical and financial systems that supported the group’s global operations.
The U.S. Department of State’s Rewards for Justice program has separately offered up to $10 million for information leading to the identification or location of individuals who conducted malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. That initiative explicitly names members of the Conti ransomware operation, which U.S. authorities have described as a ransomware-as-a-service group with links to Russian state actors.
Conti and the Wanted Aliases
The Rewards for Justice notice seeks information on actors using aliases such as “Target,” “Reshaev,” “Professor,” “Tramp,” and “Dandis,” reportedly affiliated with Conti (also called Wizard Spider). First observed in 2019, Conti is accused of carrying out more than 1,000 ransomware incidents, many of them against critical infrastructure sectors including law enforcement, emergency medical services, 9-1-1 dispatch centers, and municipal bodies. Of the more than 400 organizations the group allegedly victimized worldwide, over 290 were in the United States.
“Professor”: Vladimir Viktorovich Kvitko
GangExposed links the alias “Professor” to Vladimir Viktorovich Kvitko (born October 23, 1984), a Russian national who reportedly moved from Moscow to Dubai in late 2020. The investigation claims Kvitko helped organize carding and payment-fraud schemes that exploited weaknesses in banking systems in countries such as India, Cuba, and Iran.
The identity attribution is said to rest on correlations between Kvitko’s documented travel and periods of chat inactivity from the “Professor” account. Russian border records shown to the investigators reportedly place him in the Altai Republic on June 15–17, 2021—dates when “Professor” was silent in Conti Jabber chats—and show his return to Moscow on June 18, at which point the account became active again. Additional travel records cited include frequent trips to the UAE, Cuba, Iran, Austria, and Turkey, and since August 2022 he is reported to have remained in Dubai while managing visa renewals through short trips to the Netherlands and Austria.
GangExposed says its dossier on Kvitko includes passports, contact details, social accounts, property records, and corporate ties (including links to RM RAIL Management Company and Rosselkhozbank). The investigator published these materials in a digital archive.
Dubai as an Operational Hub
The report describes an autumn 2021 campaign in which Conti used Dubai as a tactical hub for a concentrated wave of attacks on Western, Middle Eastern, and Chinese companies. According to the timeline reconstructed from leaked chats and travel records, “Target” directed the setup of a local office with dedicated attack infrastructure, while system administrator Andrey Zhuykov and negotiator Arkady Bondarenko maintained the technical and negotiation functions.
Key events cited in the timeline:
- October 1, 2021: Chats mention a negotiator described as “a Canadian from a recovery company,” identified by GangExposed as Bondarenko; Bondarenko reportedly flew from Dubai to Moscow that day (flight EK-133), and contemporaneous conversations refer to payment problems via the Suex exchange.
- October 2, 2021: “Target” allegedly coordinated the establishment of a Dubai office and ordered equipment in collaboration with deputy Sergey Khitrov.
- October 10–14, 2021: Multiple Conti members are said to have traveled to Dubai on flights including SU-520 and G9-956; named arrivals include Marat Nurtdinov, Oleg Fakeev, Kvitko, and Elizaveta Suchkova.
- October 17–November 6, 2021: The period of peak attacks, with several high-profile incidents on specific dates (for example, seven attacks on October 17, eleven on October 23, and thirteen on November 6), affecting companies across the UAE, China, and the West.
GangExposed asserts Conti exploited the UAE’s limited extradition arrangements and lax cybercrime oversight to stage operations that targeted both international and regional firms. Bondarenko reportedly handled ransom negotiations while Zhuykov maintained hosting, proxies, control panels, and other infrastructure.
“Target”: The Alleged Leader
The alias “Target” (also reported to have used names like “Bloodrush” and “Red”) is portrayed as the ruthless leader who ran Conti with near-corporate discipline and a large operator base. U.S. authorities have offered a $10 million reward for information on this person; GangExposed’s report claims he has evaded capture for years, maintained ties to Russian security services, and accumulated significant cryptocurrency proceeds while paying operatives modest stipends.
The report highlights chat messages from the COVID-19 period in which “Target” boasted about attacks on hospitals in the United States, citing a message that named 428 hospitals and included callous remarks about their fate. GangExposed says it recovered deleted messages and metadata that document “Target’s” operational model, including the use of ephemeral communication platforms and efforts to erase forensic traces.
Arkady Bondarenko: Negotiator
Arkady Valentinovich Bondarenko (born August 2, 1970) is identified by GangExposed as Conti’s principal negotiator. Described as holding dual Russian–Canadian citizenship, Bondarenko is said to have coordinated victim communications and handled ransom payment logistics. Leaked chats and travel records reportedly show travel patterns consistent with in-person coordination with other Conti figures while avoiding shared flights.
The dossier on Bondarenko that GangExposed published allegedly documents substantial inflows of cash (more than 107 million RUB through a VTB account), ownership of luxury real estate and vehicles, and corporate entities such as LLC “Jewelry House Millennium,” which the investigators interpret as indicators of money-laundering activity. Contact details and multiple phones and emails are included in the leaked materials.
Andrey Zhuykov: Technical Lead
Andrey Yuryevich Zhuykov (born February 18, 1982), known by handles such as “Defender” or “Def,” is described as Conti’s chief system administrator and DevOps specialist. Operating from Russia’s Sverdlovsk Region and Sochi, Zhuykov is said to have managed servers, domains, VPNs, proxies, control panels, and backup channels—functions that kept Conti’s infrastructure operational and concealed.
Leaked chats attributed to Zhuykov show him liaising with leadership, suppliers, and coders, buying server time and software licenses, and running security checks. GangExposed published identifying documents linked to Zhuykov—passports, phone numbers, emails, and social accounts—and reports that despite his central technical role he faced personal financial difficulties, including debts and enforcement actions.
Other Individuals Named
GangExposed’s release names other alleged Conti figures, including Vitaly Kovalev (“Stern”), whose Telegram messages were leaked, and Mikhail Mikhailovich Tsaryov (“Mango”), a coordinator within the Conti–TrickBot ecosystem. The investigators say these additional disclosures include network maps, chat logs, and identifying documents.
Leaked Datasets and Investigative Utility
The published cache reportedly includes Jabber and RocketChat logs from Conti, Matrix chat leaks tied to related groups, and Telegram messages from key actors. GangExposed made the materials available in bulk formats (tables and CSVs), and the investigators say recovered deleted messages reveal attempts by Conti to erase evidence of the Dubai hub, the hospital attacks, and financial dealings.
According to GangExposed, Conti reacted to the exposure by offering money for an exploit to access the investigator’s Telegram account—an effort that did not succeed. The group’s attempted retaliation, the investigator says, underscores the sensitivity of the leaked material.
GangExposed argues that the dossiers and datasets provide actionable intelligence for law enforcement: UAE authorities could investigate local victims and the Dubai operations; Chinese investigators could pursue breaches affecting companies there; and Western agencies could leverage the Rewards for Justice offer and financial-trace evidence to pursue asset seizures and arrests. Bondarenko’s dual citizenship status and financial transaction records, and Zhuykov’s administrative role, are highlighted as potential points of legal leverage.
In summary, GangExposed’s disclosures claim to have pierced Conti’s veil of anonymity by identifying the individuals behind several high-level roles, documenting a Dubai operational center, and publishing extensive leaked communications and records. The investigators say their work presents a rare opportunity for international authorities to disrupt a major ransomware network.
Find this news interesting? Follow us on Google News, LinkedIn, and X for instant updates.
