New evidence linking Sergey Khitrov (aka Stanton) — now in Dubai for Blockchain Life — to the Conti ransomware group.
28.10.2025 GangExposed
twitter @gangexposed_ru
In a newly found archive, I discovered private Rocket-Chat logs of Conti & Trickbot members — including Stanton.
These files were Trick-Leaks.👇
🔹 1,200+ private messages from Stanton
🔹 Multiple crypting reports signed “Stanton”
🔹 Chat where he confirms his Jabber nick: “cosmos”
🔹 Direct communication with Bentley (Manuel) 👇
✈️ February 5, 2021 — flight SU-524 to Dubai
Passengers: Sergey Khitrov, Alexey Kurashov (Target), Vladimir Kvitko (Professor) — top Conti figures.
Total: six recorded trips to UAE.
Kurashov Aleksei — 23.02.1986
UAE — 25.02.2022, Greece — 09.08.2021, Greece — 04.08.2021, UAE — 05.02.2021
17.02.19 — Kvitko Vladimir, 23.10.1984, from the Netherlands
17.02.19 — Itrov Aleksei Aleksandrovich, 31.01.1994, from the Netherlands
17.02.19 — Khitrov Sergey Aleksandrovich, 31.01.1994, from the Netherlands
Stanton’s role — crypter:
a specialist who obfuscates and encrypts malware (lockers, loaders, backdoors) to evade AV/EDR detection.
Not the ransomware coder — the one who makes it invisible.
This directly connects him to Conti’s operational infrastructure.
In 2025, Khitrov published an autobiographical book titled “История одного КРИПТАна” (“The Story of One CRYPTan”).
The title is a phonetic reference to “crypter” — his real past role in Conti.
A self-ironic Easter egg hiding in plain sight.
In Conti chats, Stanton mentions the death of his son — a tragic story that also appears in his book (with himself as the patient).
This unique overlap further confirms authorship and timeline authenticity.
These materials were found independently, verified via multiple OSINT sources (flight data, leaks, and metadata).
Archive attached for researchers and investigators.
https://mega.nz/file/Q5YgSbgb#l79YqrjeXQXk9pzCfT0_Px1NrTOcjvNAQ2PEAhIJJ8E
More details:
I also noticed a possible early connection between the Khitrov brothers (and their companions — likely their team) and Vladimir Kvitko (Professor). On one day, 07.02.2019, they flew out of the Netherlands, but on different flights.
I checked Stanton’s correspondence in detail. His second nickname in Jabber is “cosmos.”
Stern paid Stanton/Cosmos ~$1,000 every week. It’s not a large sum, and I assume this salary went to a probable assistant/employee of Khitrov for crypting. The role of a crypter is not the most central, but it’s very important in the group. Khitrov could delegate such a task to his employee. But in Jabber and Rocket-Chat, Khitrov himself communicated directly — stylometry and stylistic analysis indicate a single authorship there.
Sergey Khitrov hides his connection with Alexey Kurashov (one of the Conti leaders under the nickname Target) on Instagram. In joint photos (from February 2021), he obscures Kurashov’s face.
Conti members. Dubai, UAE, February 7, 2021.
Fakeev
Nurtdinov
Khitrov S
Kurashov (Target)
Khitrov A
? Unknown
Shvaikov
Someone, share all of this with the FBI, or intelligence services, law enforcement agencies, or Dubai’s cyber police.
If they can’t take down the Conti gang now, it will be ridiculous.
The day after tomorrow, these guys will leave the UAE and won’t show their faces outside of Russia again.
Question: Why did Sergey Khitrov take such a risk? He’s practically five minutes away from being Osama bin Laden…
Answer: In Singapore, at Token2049, he met Pavel Durov and invited him to his Blockchain Life event.
And tomorrow, @durov is coming as a guest and will speak there.
Telegram + Conti = friendship?