Loading threat actor…
Conti, also known as the Conti gang, Conti group, and Conti ransomware group, was a Russia-linked, financially motivated cybercriminal syndicate that emerged in 2020 and operated a ransomware-as-a-service program until its shutdown in 2022. Its developers supplied ransomware and operational guidance to affiliates in exchange for a share of ransom proceeds. Conti targeted enterprises and public-sector organizations, including healthcare and emergency-service networks in the United States, Ireland’s Health Service Executive, and Costa Rican government institutions. Conti combined network-wide encryption with theft of sensitive information to support double extortion. Karakurt operated within the syndicate as a data-theft extortion brand, including in cases where defenders blocked Conti’s encryptor. Conti obtained access through criminal brokers and malware-delivery ecosystems involving Emotet, IcedID, and TrickBot. From October 2021, its operators also sold access to compromised victim networks. Post-compromise operations emphasized Active Directory reconnaissance, credential dumping, privilege escalation, and lateral movement to obtain domain-wide control. Affiliates used Cobalt Strike, Mimikatz, AdFind, BloodHound, Kerberoasting, pass-the-hash, and password guessing. Their guidance covered exploitation of Zerologon and PrintNightmare, alongside vulnerabilities affecting externally accessible enterprise systems. Operators abused legitimate remote-management applications for persistent access, used Rclone and cloud storage for exfiltration, disabled security controls, and deleted shadow copies before mass encryption. Financial records, insurance documents, and backup information were collection priorities for strengthening ransom negotiations. An affiliate leaked Conti’s operational playbook in 2021, and internal communications and source code were exposed in 2022. Public support for Russia’s government during the invasion of Ukraine generated an internal political rift. Following Conti’s dissolution, some former members continued operating through other ransomware groups, including Black Basta.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
60 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
34 malware families attributed to this actor across reporting.
29 additional families tracked in Mallory.
37 CVEs this actor has used in observed campaigns. 37 of them exploited in the wild.
“Conti and its affiliates will try to leverage Zerologon to obtain domain admin privileges.”
Microsoft announced the existence of CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, and with their powers combined, they are ProxyShell. These vulnerabilities... leverage pre-auth path confusion for ACL bypass, elevation of privilege on the Exchange PowerShell backend, and post-auth arbitrary file writes to install a web shell onto the compromised system. | Pre-Auth Path Confusion ACL Bypass (CVE-2021-34473)
The leaked affiliate playbook indicated use of PrintNightmare. The table identifies CVE-2021-34527 as Windows Print Spooler Remote Code Execution Vulnerability ("PrintNightmare").
Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI-related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
32 more CVEs tied to this actor tracked in Mallory.
209 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as an example of ransomware actors purchasing existing access rather than performing the initial intrusion themselves. No specific RAT association is established.
A ransomware group connected to the botnet and loader ecosystem discussed in the article. Conti used IcedID and TrickBot for initial access and ransomware staging, and its operators overlapped heavily with the TrickBot group. The article states that Conti fractured in early 2022.
A defunct ransomware syndicate mentioned as the likely former affiliation of some Silent Ransom Group core members. No current Conti involvement in the described activity is established.
Defunct ransomware syndicate mentioned as the possible former organization of Silent Ransom Group's core members. The connection is assessed as likely, not confirmed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.