about pony data back them 2016, there are information when source code of dyre was shared through yandex disk. they infected themselves, and there are their data! try to do analytics job and investigate that!
and funny , you should separate accounts what conti/trick paid to workers , and what they got from ransom. they still have them on btc, and transfer only for their expense. try to monitor their wallets! that they doesnt have possibility to cashout!
for now stern/deamon - try to hide himeself, changing nicknames, wants to make some voice calls :) reshaev/cyberganster - in total panic. tramp - doing somethings unknown! We know everything about you Conti, go to panic, you can even trust your gf , we against you!