RansomwareATT&CK S0575
Conti
Conti was a ransomware-as-a-service family that CISA, the FBI and the NSA warned about in a September 2021 joint advisory, which reported more than 400 attacks on US and international organisations at that time. Operators typically entered through phishing or stolen remote-access credentials, often with TrickBot and Cobalt Strike, then stole data and encrypted networks.
- Public attribution and associated actors
- MITRE ATT&CK lists Conti as used by Wizard Spider.As publicly reported:ContiWizard Spider
- First seen
- Around 2020
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0575 Conti
How it spreads or gets in
- Initial access via spearphishing, stolen or weak RDP credentials, phone-based social engineering, and loaders such as TrickBot (CISA AA21-265A).
- Lateral movement with Cobalt Strike and administrative shares.
Key behaviours
- Discovered network shares and encrypted them as well as local files.
- Injected its code into other processes.
- Deleted shadow copies and stopped services before encryption.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1055.001Process Injection: Dynamic-link Library Injection
- T1135Network Share Discovery
- T1080Taint Shared Content
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1489Service Stop
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Hunt for Cobalt Strike beacons and unexpected remote administration tools.
- Alert on a single host enumerating many network shares.
- Detect shadow-copy deletion and mass file renames.
Defences that work
- Require MFA for remote access and email.
- Segment networks and limit SMB between workstations.
- Filter email attachments and links, and train staff on phone-based lures.
- Keep offline, tested backups.