Using Data Science Tools for Investigating Chat Logs from the Conti Ransomware Group

The main goal of this paper is to showcase some results from a comprehensive data analysis that we did on the cache of chat logs from the notorious ransomware group Conti. The chat logs were made publicly available on February 27, 2022. They were translated from Russian into English, and contain 393 json files with chat logs from the instant messaging service Jabber. We employ a variety of modern data science tools for text mining, natural language processing, network analysis and geospatial analysis to investigate the Conti chat logs so that we can understand the command and control structure of the network and discover any valuable information hidden in the data, such as Bitcoin, IP, email and web addresses, as well as any other information that can lead to further insights into the inner workings of the Conti group.