Netskope Threat Labs

Conti

ATP Sandbox Adv. HeuristicsAV

Description

Conti is a Russian based ransomware as a service group that became one of the most prolific extortion operations in the world before its collapse. Its affiliates compromised large organizations through phishing, credential theft, and exploitation of perimeter services, exfiltrated data, and demanded multi million dollar ransoms. A disgruntled affiliate leaked its source code and internal chat logs in 2021, exposing internal operations, and the group dissolved in 2022 as its members moved to successor operations.

Stats

First seen
March 2022
Last seen
October 2026

MITRE ATT&CK techniques

16 techniques across 5 tactics.

TA0002 Execution

TA0005 Stealth

  • T1027Obfuscated Files or Information
  • T1055Process Injection
  • T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1083File and Directory Discovery
  • T1135Network Share Discovery

TA0008 Lateral Movement

TA0040 Impact

  • T1486Data Encrypted for Impact
  • T1489Service Stop
  • T1490Inhibit System Recovery

Associated groups

Associated campaigns

Alert name variants

Alert Name
Gen:Variant.Ransom.Conti.103
Gen:Variant.Ransom.Conti.119
Gen:Variant.Ransom.Conti.13
Gen:Variant.Ransom.Conti.135
Gen:Variant.Ransom.Conti.143
Gen:Variant.Ransom.Conti.160
Gen:Variant.Ransom.Conti.22
Gen:Variant.Ransom.Conti.33
Gen:Variant.Ransom.Conti.47
Gen:Variant.Ransom.Conti.59

Related blogs

Related families

Cobalt StrikeQilinRyukCubaAvaddon

References