Loading story…
Conti ransomware continued to operate with updated capabilities that improved both evasion and impact in enterprise networks. Research shows the malware is commonly delivered through a multi-stage, fileless-style chain using Cobalt Strike, Meterpreter, and reflective DLL injection so the final ransomware payload can run largely from memory and remain off disk until the attack is underway. Once launched, Conti encrypts local systems and SMB-accessible shares, scans subnets for lateral movement, and in some cases pairs encryption with data-theft extortion by threatening to leak stolen files hosted on services such as Mega.
Technical analyses describe Conti as optimized for speed and disruption, using aggressive multi-threading, selective encryption, and per-file ChaCha keys protected by RSA public-key cryptography. Later variants added command-line options to reboot victims into Windows Safe Mode with networking, automatically log in with administrator credentials, and continue encrypting while many security tools are disabled. The malware also deletes Volume Shadow Copies, changes API hashing and encrypted file extensions to frustrate detection, and streamlines ransom negotiations through direct victim-specific TOR chat links.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
A Ukrainian researcher published leaked Conti source code and chat logs after the invasion of Ukraine. The leak occurred after the January 2022 malware update, and the report notes the most recent ransomware code had not been leaked at that time.
ThreatLabz identified an updated Conti ransomware build in late January 2022 that added Safe Mode reboot and auto-logon capabilities, changed API hashing behavior, updated encrypted file extensions, and modified the ransom-payment workflow.
Sophos published analysis showing Conti being delivered through a multi-stage Cobalt Strike and Meterpreter infection chain using reflective DLL injection, with the ransomware payload briefly hosted on command-and-control servers only during active attacks.
A reverse-engineering analysis documented Conti ransomware version 2 as a 32-bit Windows ransomware family optimized for fast encryption in business environments, including local and SMB share encryption, multi-threading, and shadow copy deletion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcezscaler.com
Open sourcechuongdong.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conti emerged as one of the most active **ransomware-as-a-service** operations, using spearphishing, exposed `RDP`, and loaders such as **BazarLoader**, **TrickBot**, **IceID**, and **Emotet** to gain access before deploying **Cobalt Strike**, stealing data, and encrypting systems across networks. Security reporting tied the group to more than 400 attacks globally, with victims concentrated in North America and Europe, and described technical tradecraft including credential attacks, shadow copy deletion, service termination, remote `SMB` encryption, and ransom notes named `CONTI_README.txt`. In industrial environments, Dragos said ransomware became the leading cause of compromises in 2021, with **Conti** and **LockBit 2.0** accounting for more than half of observed incidents, while suspected Conti-linked activity was later detected at major automotive manufacturers and suppliers in North America and Japan. Leaked internal chats, source code, and infrastructure data exposed Conti as a highly organized criminal business rather than a loose affiliate network. Researchers identified a core group of roughly 44 members within a wider set of 442 chat handles, with dedicated teams for coding, reverse engineering, OSINT, HR, payroll, and a "**Fire Team**" that conducted victim research, built phishing phone and email scripts, and helped pressure victims during ransom negotiations using tools such as **Shodan**, **SpiderFoot**, **SignalHire**, and **ZoomInfo**. The group’s impact was illustrated by the attack on Ireland’s **Health Service Executive**, where about **80%** of IT systems were encrypted, roughly **700 GB** of data was stolen, and healthcare services were disrupted nationwide before Conti offered a free decryptor while still demanding a **$20 million** ransom and threatening to leak the data.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026