Monti

Monti is a ransomware group/family described as a Conti “doppelganger” that emerged after Conti’s shutdown and impersonated Conti’s TTPs and tools. Reporting cited in the source material links the operation at various times to Mikhail Matveev (aka Wazawaka), stating he operated and managed the Monti ransomware operation. Monti has been observed targeting healthcare at a disproportionate rate; one cited analysis states 20.8% of its attacks were against healthcare organizations, and reporting also describes it as focused on critical infrastructure. A reported victim listed on its dark web site in August 2024 was Excelsior Orthopedics. The group is associated with double-extortion style pressure tactics and public shaming. Source material states Monti claimed to have found evidence that an employee at a victim organization searched for child sexual abuse material and threatened to report it to authorities if the ransom was not paid. It also states Monti published a business owner’s Social Security number and an edited image intended to humiliate and intimidate them. Monti has also been linked to credential theft and defense evasion tooling. Symantec noted that malware used to steal credentials stored in Veeam backups has been used by Monti, alongside other ransomware groups. ESET reported detecting BlackSnufkin’s TfSysMon-Killer during a Monti ransomware attack in February 2025; the deployed variant had identical functionality to the original but was reimplemented from Rust to C++. Known aliases in the provided content are Monti and Storm-1194.