Thread by @WIRED

WIRED has seen hundreds of internal messages sent between members of Trickbot, the notorious Russian ransomware gang. The exchanges detail the inner workings of the hacking group that targeted over 400 US hospitals. wired.trib.al/OglzYdH 🎨: Jacqui VanLiew/Getty 1/10

Members of Trickbot privately gloated over what easy targets hospitals and health care providers make.
Their aim: to force hospitals busy responding to the surging Covid-19 pandemic to quickly pay ransoms.
🎨: Jacqui VanLiew/Getty 2/10

Reporting by @mattburgess1 reveals key members’ aliases and shows the ruthless attitude held by members of this criminal gang that consists of 100+ disciples. But a core team of around half a dozen criminals rule Trickbot’s operations. 🎨: Jacqui VanLiew/Getty 3/10

The group evolved from the banking trojan Dyre around the end of 2015 and has grown to become an all-purpose hacking toolkit. Each senior member has their own speciality, like managing teams of coders or heading up ransomware deployments. 4/10

And they’re expanding. Chat logs from 2020 describe the group's plans to grow in the coming weeks. “There will be 6 offices for sure and 50-80 people by the end of September.” 5/10

Coders and developers recruited by Trickbot are drawn in from job postings on dark web forums but also on open web Russian-language freelancer websites. 6/10

While many of the ads are hiding in plain sight, they don’t explicitly say successful applicants will be working for one of the world’s most ruthless cybercriminal groups. 7/10

Despite the arrests and wider ransomware crackdowns in Russia, the Trickbot group doesn't seem to be going into hiding anytime soon. 8/10

Read more of WIRED's exclusive reporting here: wired.trib.al/OglzYdH 9/10

Get your first year of WIRED for just $5 and get unlimited access to our longform features, buying guides, and tech news. wired.trib.al/y56Mi3d 10/10