Cyber Leaders

The episode densely packs specific operational details about Conti's business model evolution, internal dynamics from leaked messages, and concrete examples (Graph Diamonds, RedCar Cleveland, Irish HSE, Costa Rica). However, roughly 8-10 minutes of the 49-minute runtime consists of intro banter, tangential jokes, and host setup that dilutes insight delivery.

“Accused by the US government of making north of$150 million worth of ransom in one year. And that, by the way, is a vast underestimate.”

“I'm currently 47,000 messages into those messages, trying to sort of pull out insight and trying to pull out data, but also trying to pull out sentiment from those messages.”

The episode's core originality lies in Geoff White's access to and analysis of 350,000 leaked Conti internal messages - a genuinely rare primary source that yields fresh insights into criminal psychology and operational mechanics. The framing of ransomware as competitive business rather than crime is thoughtful, though the frameworks themselves (state of nature, business model evolution) are not entirely novel.

“What was useful about Conti was that for reasons we can go into, there was a huge leak of Conti's internal messages. Something like 350,000 internal messages from inside Conti came out.”

“They describe themselves as post-paid penetration testers... the idea that you would normally pay for a penetration test to expose your vulnerabilities. Well, we've done one of those tests, we just didn't tell you we were doing it, and you failed, so now you have to pay us.”

Geoff White is an exceptional guest for this topic: he's a published cyber-crime journalist (three books), BBC podcast creator/producer, has direct access to unique primary sources (leaked messages), conducted original fieldwork including interviews with victims and identifying alleged gang members via open-source investigation. He brings rare expertise that neither host possesses.

“he has written the book on cybercrime, or more accurately, three of them. And his expose of another extraordinary group of evil hackers, the Lazarus group, was so popular that BBC turned it into a very successful podcast.”

“I'm currently 47,000 messages into those messages”

Strong use of named entities, specific dollar amounts, timelines, and documented examples. The episode cites $7.5M ransom for Graph Diamonds, $150M+ annual revenues, 350,000 leaked messages, specific dates (Sept 2021 Graph attack, Feb 2022 Ukraine invasion trigger, April-May 2022 Costa Rica), named individuals (Vitaly Kovalev/Stern), and concrete case studies with verifiable impacts (RedCar Cleveland, Irish HSE). Some claims lack full substantiation but are presented carefully.

“They're accused of making upwards of$500 million between them.”

“we came up with a figure about 400 years.”

Hosts ask substantive follow-ups and push White on nuance (e.g., questioning whether Kremlin controls gangs, probing why Ireland's HSE received the decryptor key). However, much airtime is lost to extended tangential jokes, host banter about coffee machines and Tom Conti, and self-referential humor that doesn't advance understanding. The quiz opening, while entertaining, is largely filler. Hosts occasionally miss opportunities to press deeper.

“Why do you think, or do the messages tell us anything about why they handed over the decryptor key?”

“I slightly push back on what some people say, which is all, I bet the Kremlin run all of this and all these gangs are actually tracking back to the Russian government. I just don't think that's true.”