Loading malware…
Conti is a targeted Windows ransomware family operated by the Conti cybercrime syndicate from 2020 until the operation’s 2022 decline and cessation. It was used in double-extortion attacks: operators encrypted victim data while threatening to publish previously stolen information if payment was not made. The operation functioned through a structured affiliate-oriented model and reportedly relied heavily on initial-access brokers and existing post-compromise tooling. Conti activity targeted large organizations across sectors and was associated with intrusions involving exposed remote services, VPN weaknesses, server vulnerabilities, and access obtained through malware such as TrickBot and QakBot.
Conti encrypts local files, accessible network shares, and remote SMB-accessible resources. Its ransomware implementation uses multithreaded encryption, per-file ChaCha8 keys protected with an embedded RSA public key, and different encryption modes based on file type and size. It can enumerate nearby private-network hosts through ARP data, probe SMB availability, and encrypt reachable administrative shares; this behavior is remote file encryption rather than self-propagation. Conti also terminates applications locking targeted files through Windows Restart Manager and deletes volume shadow copies to impede recovery.
The malware employs layered in-memory execution using shellcode and reflective loading, encrypted strings and API resolution, anti-analysis logic, and execution controls intended for hands-on operator deployment. Conti operators conducted reconnaissance, credential access, privilege escalation, lateral movement using SMB and RDP, and data theft before ransomware deployment. Reported tooling included PowerShell, Cobalt Strike, Mimikatz, Kerberoasting, Zerologon-related techniques, and Microsoft Exchange remote-code-execution exploits. Data was commonly exfiltrated using cloud-storage and file-transfer tooling. Conti’s source code and internal materials were leaked in 2022, contributing to code reuse and derivative ransomware families.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Mimikatz, UAC Bypass, and Zerologon are a privilege escalation holy trinity with some help of NTDS dumps. | Published On : 2022-03-19 Conti gang is one of the largest cybercrime syndicates in the world... Their coders focus on locker code and botnet networks.
Conti has been particularly quick to adopt the latest vulnerability SMB and RDP exploits, such as PrintNightmare. | Published On : 2022-03-19 Conti gang is one of the largest cybercrime syndicates in the world... Their coders focus on locker code and botnet networks.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The initial remote code execution vulnerability (CVE-2021-44228) has been dubbed Log4Shell... The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti. | The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti.
They check for the “PrintNightmare” vulnerability (CVE-2021-34527) in Windows Print spooler service, EternalBlue vulnerability (CVE-2017-0144) in Microsoft Windows Server Message Block, and the “Zerologon” vulnerability (CVE-2020-1472) in Microsoft Active Directory Domain Controller. | Conti is a sophisticated Ransomware-as-a-Service (RaaS) model first detected in December 2019.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
Intel-SA-00307 CSME versions before 12.0.49 (IOT only: 12.0.56), 13.0.21, 14.0.11. CVE-2019-14598 Local privilege escalation
Intel-SA-00185 CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 CVE-2018-12196 CVE-2018-12200 CVE-2018-12190 Local execution of arbitrary code and local privilege escalation.
Intel-SA-00112 Manageability Engine Firmware version 3.x,4.x,5.x,6.x,7.x,8.x,9.x, 10.x,11.x CVE-2018-3628 RCE on same subnet
Intel-SA-00391 CSME and AMT versions before 11.8.82, 11.12.82, 11.22.82, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 NPE: CVE-2020-8752 LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760 Unauthenticated network privilege escalation. Local privilege escalations.
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00086 ME – 6.x/7.x/8.x/9.x/10.x//11.0/11.5/11.6/11.7/11.10/11.20 CVE-2017-5705 CVE-2017-5711 CVE-2017-5712
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00459 CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 CVE-2020-8703 Local privilege escalation
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
29 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Een handleiding hoe een ransomware-aanval met data-exfiltratie uitgevoerd moet worden door Conti-affiliates is gelekt in 2021.
...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
Conti cyberthreat actors remain active and Conti ransomware attacks against U.S. and international organizations have risen to more than 1,000. Notable attack vectors include Trickbot and Cobalt Strike.
The Conti Group is renowned for being a very successful Ransomware operator and the gang have terrorized businesses worldwide by encrypting their networks for a ransom and also threatening to leak data if not paid.
Based on data from the leak sites of their operators, 35.8% of these attacks were attributed to LockBit, while 19% belonged to Conti and 9.6% to BlackCat.
We noticed that only certain affiliates have access to a Linux variant of the Conti ransomware, targeting ESXi systems.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
ファイルレスとなるReflective PE Injectionを複数使用した解析検知妨害や、動作中に使用する全ての文字列やAPIに暗号化を施すなど...
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Conti has loaded an encrypted DLL into memory and then executes it.
Contiランサムウェアは、動作中に使用する全てのWindows APIを暗号化しています。...使用するたびに必要なWindows APIのアドレスを復号した上で呼び出します。...文字列ごとに用意された関数で使うたびに復号して使用します。
このシステムファイルへの属性変更処理は通常のWindows環境であれば常に失敗する処理となります。...属性変更処理が"成功した場合"のみ自身を終了し、"失敗した場合"のみ自身を継続する処理に遷移します。
Contiランサムウェアは実行されるとすぐにWindowsのメモ帳である「C:\Windows\notepad.exe」の属性変更を試みます。
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Mimic’s port-scanning functionality is based on the leaked Conti builder.
Conti can enumerate routine network connections from a compromised host.
RmGetList関数を呼び出すことで該当ファイルを使用中のアプリケーション情報をWindowsOSから得ることができます。その後、Contiはファイルを使用中のアプリケーションがexplorer.exeの場合のみ例外的に強制終了から除外...
Contiランサムウェアは暗号化対象端末を選定し暗号化していきます...FindFirst/FindNextFileなどの一般的なファイル操作関数を用いてローカルファイルと同じように探索し暗号化していきます。
Contiランサムウェアは同一ネットワーク上の共有フォルダやネットワーク上の他の端末のファイルを暗号化する能力を持っている...アクセスできる端末やフォルダが見つかった場合...探索し暗号化していきます。
このシステムファイルへの属性変更処理は通常のWindows環境であれば常に失敗する処理となります。...属性変更処理が"成功した場合"のみ自身を終了し、"失敗した場合"のみ自身を継続する処理に遷移します。
“bestanden versleutelen” en “Single extortion: bestanden of systemen van het slachtoffer zijn versleuteld.”
This flag allows the ransomware to kill those processes that have the selected files for encryption | kills the “lsass” process to reboot the infected machine
189 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware whose leaked builder code was used as a basis for portions of Mimic's implementation.
A ransomware family whose leaked source code is described as the basis from which Gunra's code appears to have been derived.
Referenced as an example of real-world ransomware whose cryptography is analyzed using the same reverse-engineering and anti-analysis techniques discussed in the article.
Conti is a ransomware operation that used TrickBot-provided initial access and remote footholds to compromise networks, gain administrative control, steal data, and deploy ransomware at scale. The article emphasizes its close operational alignment with TrickBot and its in-house, tightly controlled intrusion model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.