Loading malware…
Conti was a major financially motivated ransomware operation active from 2020 until its 2022 shutdown. It operated as a ransomware-as-a-service ecosystem involving core operators, developers, affiliates, initial-access brokers, and other specialized roles. Conti conducted double-extortion attacks: operators compromised organizational networks, moved through victim environments, stole sensitive data, encrypted systems, and threatened public disclosure of stolen information to coerce payment. The operation targeted more than 1,000 victims globally, including corporate networks, healthcare providers, schools, local governments, and other critical-infrastructure organizations. Conti affiliates and operators used reconnaissance, credential theft, lateral movement, data exfiltration, encryption, and ransom negotiations. The group was associated with the wider TrickBot cybercrime ecosystem and relied extensively on legitimate administrative utilities and established offensive tooling. Conti disbanded after internal communications and source code were leaked in 2022; personnel and resources subsequently dispersed into other ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Mimikatz, UAC Bypass, and Zerologon are a privilege escalation holy trinity with some help of NTDS dumps. | Published On : 2022-03-19 Conti gang is one of the largest cybercrime syndicates in the world... Their coders focus on locker code and botnet networks.
Conti has been particularly quick to adopt the latest vulnerability SMB and RDP exploits, such as PrintNightmare. | Published On : 2022-03-19 Conti gang is one of the largest cybercrime syndicates in the world... Their coders focus on locker code and botnet networks.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The initial remote code execution vulnerability (CVE-2021-44228) has been dubbed Log4Shell... The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti. | The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti.
They check for the “PrintNightmare” vulnerability (CVE-2021-34527) in Windows Print spooler service, EternalBlue vulnerability (CVE-2017-0144) in Microsoft Windows Server Message Block, and the “Zerologon” vulnerability (CVE-2020-1472) in Microsoft Active Directory Domain Controller. | Conti is a sophisticated Ransomware-as-a-Service (RaaS) model first detected in December 2019.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
Intel-SA-00307 CSME versions before 12.0.49 (IOT only: 12.0.56), 13.0.21, 14.0.11. CVE-2019-14598 Local privilege escalation
Intel-SA-00185 CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 CVE-2018-12196 CVE-2018-12200 CVE-2018-12190 Local execution of arbitrary code and local privilege escalation.
Intel-SA-00112 Manageability Engine Firmware version 3.x,4.x,5.x,6.x,7.x,8.x,9.x, 10.x,11.x CVE-2018-3628 RCE on same subnet
Intel-SA-00391 CSME and AMT versions before 11.8.82, 11.12.82, 11.22.82, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 NPE: CVE-2020-8752 LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760 Unauthenticated network privilege escalation. Local privilege escalations.
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00086 ME – 6.x/7.x/8.x/9.x/10.x//11.0/11.5/11.6/11.7/11.10/11.20 CVE-2017-5705 CVE-2017-5711 CVE-2017-5712
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00459 CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 CVE-2020-8703 Local privilege escalation
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
29 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lytvynenko pleaded guilty to wire fraud after admitting to helping the Conti group develop malware and possessing stolen victim data. The Conti operation encrypted victims' files and threatened to leak stolen information unless victims paid.
Een handleiding hoe een ransomware-aanval met data-exfiltratie uitgevoerd moet worden door Conti-affiliates is gelekt in 2021.
...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
Conti cyberthreat actors remain active and Conti ransomware attacks against U.S. and international organizations have risen to more than 1,000. Notable attack vectors include Trickbot and Cobalt Strike.
The Conti Group is renowned for being a very successful Ransomware operator and the gang have terrorized businesses worldwide by encrypting their networks for a ransom and also threatening to leak data if not paid.
Based on data from the leak sites of their operators, 35.8% of these attacks were attributed to LockBit, while 19% belonged to Conti and 9.6% to BlackCat.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
ファイルレスとなるReflective PE Injectionを複数使用した解析検知妨害や、動作中に使用する全ての文字列やAPIに暗号化を施すなど...
Conti has loaded an encrypted DLL into memory and then executes it.
Contiランサムウェアは、動作中に使用する全てのWindows APIを暗号化しています。...使用するたびに必要なWindows APIのアドレスを復号した上で呼び出します。...文字列ごとに用意された関数で使うたびに復号して使用します。
このシステムファイルへの属性変更処理は通常のWindows環境であれば常に失敗する処理となります。...属性変更処理が"成功した場合"のみ自身を終了し、"失敗した場合"のみ自身を継続する処理に遷移します。
Contiランサムウェアは実行されるとすぐにWindowsのメモ帳である「C:\Windows\notepad.exe」の属性変更を試みます。
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Mimic’s port-scanning functionality is based on the leaked Conti builder.
Conti can enumerate routine network connections from a compromised host.
RmGetList関数を呼び出すことで該当ファイルを使用中のアプリケーション情報をWindowsOSから得ることができます。その後、Contiはファイルを使用中のアプリケーションがexplorer.exeの場合のみ例外的に強制終了から除外...
Contiランサムウェアは暗号化対象端末を選定し暗号化していきます...FindFirst/FindNextFileなどの一般的なファイル操作関数を用いてローカルファイルと同じように探索し暗号化していきます。
Contiランサムウェアは同一ネットワーク上の共有フォルダやネットワーク上の他の端末のファイルを暗号化する能力を持っている...アクセスできる端末やフォルダが見つかった場合...探索し暗号化していきます。
このシステムファイルへの属性変更処理は通常のWindows環境であれば常に失敗する処理となります。...属性変更処理が"成功した場合"のみ自身を終了し、"失敗した場合"のみ自身を継続する処理に遷移します。
"a conspiracy to deploy Conti, a ransomware variant that infected the computers of more than 1,000"
This flag allows the ransomware to kill those processes that have the selected files for encryption | kills the “lsass” process to reboot the infected machine
189 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A double-extortion ransomware operation that breached victim networks, exfiltrated sensitive data, encrypted devices, and issued ransom demands. It was active from 2020 until 2022, targeted organizations globally including healthcare and critical infrastructure, and collected an estimated $150 million in ransom payments as of January 2022.
A ransomware operation that conducted double-extortion attacks: it stole victim data, encrypted systems, and demanded cryptocurrency payments while threatening to release stolen information. The operation targeted organizations in the United States and other countries, reportedly receiving more than $150 million in ransom payments by January 2022. It ceased operations in 2022 following mounting pressure and leaks of internal communications and source code.
Ransomware used to extort victims and steal their data. The operation infected more than 1,000 organizations worldwide; FBI-estimated victim payments exceeded $150 million as of January 2022. The operation shut down in 2022 following leaks of its internal chats and source code.
Ransomware variant deployed in a wire-fraud conspiracy; it infected computers of more than 1,000 victims.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.