RansomwareFinancial gain
Conti
Also known as: Conti ransomware
Conti was among the most damaging ransomware operations of 2020 to 2022. It was frequently delivered through TrickBot and Cobalt Strike, stole data before encrypting it, and hit public services including hospitals. CISA and the FBI had observed it in more than 400 attacks by September 2021.
- Public attribution
- A ransomware-as-a-service operation first observed in December 2019 (MITRE ATT&CK); MITRE records Wizard Spider using Conti ransomware.
- Active since
- Around 2019
- Targets
- Large companies and government agencies, especially in North America
- Healthcare and emergency services
- Tracked by MITRE ATT&CK as software
- S0575 Conti
Status: Widely reported to have shut down its brand in mid-2022, with members moving to other operations.
Notable campaigns
2020Healthcare targeting
Named alongside Ryuk in the 2020 CISA, FBI and HHS warning about threats to US hospitals.
2021More than 400 attacks
CISA and the FBI reported Conti in more than 400 attacks on US and international organisations.
Signature ATT&CK techniques
- T1083File and Directory Discovery
- T1135Network Share Discovery
- T1055.001Process Injection: Dynamic-link Library Injection
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1489Service Stop
- T1490Inhibit System Recovery
- T1486Data Encrypted for Impact
Selected from MITRE ATT&CK's software entry and the cited government advisory.
Defences that work against this actor
- Require MFA for remote access and segment networks so one compromised host cannot reach every share.
- Hunt for Cobalt Strike beacons and loader malware; they usually precede encryption by days.
- Restrict SMB between workstations.
- Keep offline backups and rehearse restoring them.