Loading story…
A confirmed Conti ransomware intrusion began with an outdated FortiGate firewall, giving attackers initial access before they escalated privileges to domain administrator, moved laterally, and staged ransomware across nearly 300 systems. Investigators linked the entry point to likely exploited FortiGate vulnerabilities including CVE-2018-13379 and CVE-2018-13374, after which the attackers deployed Cobalt Strike beacons, used WMI for remote execution, and relied on batch scripts and reflective DLL injection to prepare the malware rollout.
The attackers also exfiltrated sensitive departmental data to MEGA using RClone before attempting to launch Conti broadly across the environment. Sophos said protected endpoints blocked the ransomware while unprotected devices were affected, and its Rapid Response team contained the incident and helped restore most critical infrastructure within 24 hours of engagement. The case illustrates how unpatched perimeter appliances can enable full-domain compromise, data theft, and large-scale ransomware deployment.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
The post-incident investigation identified a possible second data exfiltration, a second compromised account, and suspicious RDP traffic through the vulnerable firewall. Sophos also confirmed the outdated FortiGate device was the likely initial intrusion point.
By day 5, less than 24 hours after Sophos Rapid Response was engaged, the customer had restarted most critical infrastructure. The victim then recovered unprotected machines from backups or by re-imaging, deployed Sophos protections, and enabled multi-factor authentication on the VPN.
After ransomware deployment began, the victim blocked all internet traffic except Sophos traffic, shut down critical infrastructure, and engaged Sophos Rapid Response. Within the first 45 minutes, responders identified the compromised account, blocked the malicious DLL and C2 addresses, identified targeted endpoints, deployed Sophos Managed Threat Response, and began collecting forensic evidence; within the next 45 minutes they also built a list of exfiltrated data.
About 40 minutes after deployment, the Cobalt Strike beacons activated and used reflective DLL injection to fetch and execute the Conti ransomware payload directly in memory from command-and-control infrastructure. Sophos Intercept X blocked Conti on protected computers over the next three hours, but unprotected devices were damaged.
At about 1:00 a.m. local time on day 4, the attackers used batch scripts and prepared host lists to copy Cobalt Strike loaders to nearly 300 endpoints and servers. They tested execution on one server first, then used WMI and rundll32.exe to launch the loaders across server and workstation targets.
On day 3, the attackers spent about 10 hours identifying and exfiltrating potentially valuable data. They deployed RClone on the third server with MEGA credentials and stole data from Human Resources, IT, credit, accounting, senior staff, and budget-related directories, while also running a batch script to search for credential-related XLSX files.
On the first day of the intrusion, the attackers deployed Cobalt Strike, ran reconnaissance commands, and mapped the victim network. After the victim detected and shut down one compromised server, the attackers pivoted to a second server and resumed the intrusion, then used a compromised domain admin account and WMI to deploy another beacon to a third server.
An unnamed organization was compromised through a FortiGate firewall running vulnerable firmware version 5.6.3 build 1547(GA). Sophos later confirmed the outdated firewall was the initial access vector, with the attackers gaining domain admin access to two servers within 16 minutes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conti emerged as one of the most active **ransomware-as-a-service** operations, using spearphishing, exposed `RDP`, and loaders such as **BazarLoader**, **TrickBot**, **IceID**, and **Emotet** to gain access before deploying **Cobalt Strike**, stealing data, and encrypting systems across networks. Security reporting tied the group to more than 400 attacks globally, with victims concentrated in North America and Europe, and described technical tradecraft including credential attacks, shadow copy deletion, service termination, remote `SMB` encryption, and ransom notes named `CONTI_README.txt`. In industrial environments, Dragos said ransomware became the leading cause of compromises in 2021, with **Conti** and **LockBit 2.0** accounting for more than half of observed incidents, while suspected Conti-linked activity was later detected at major automotive manufacturers and suppliers in North America and Japan. Leaked internal chats, source code, and infrastructure data exposed Conti as a highly organized criminal business rather than a loose affiliate network. Researchers identified a core group of roughly 44 members within a wider set of 442 chat handles, with dedicated teams for coding, reverse engineering, OSINT, HR, payroll, and a "**Fire Team**" that conducted victim research, built phishing phone and email scripts, and helped pressure victims during ransom negotiations using tools such as **Shodan**, **SpiderFoot**, **SignalHire**, and **ZoomInfo**. The group’s impact was illustrated by the attack on Ireland’s **Health Service Executive**, where about **80%** of IT systems were encrypted, roughly **700 GB** of data was stolen, and healthcare services were disrupted nationwide before Conti offered a free decryptor while still demanding a **$20 million** ransom and threatening to leak the data.
Aug 15, 2026
Conti affiliates compromised an unpatched on-premises **Microsoft Exchange Server 2016** by exploiting the **ProxyShell** vulnerability chain, then established multiple web shells within minutes to secure persistent access. Investigators said the attackers quickly conducted reconnaissance, dumped **LSASS** credentials, and expanded access across the environment using a cracked domain administrator account while deploying tools including **Cobalt Strike** and **AnyDesk**. Over about five days, the intruders exfiltrated nearly **1 TB** of data using **Rclone** and **Mega** before launching **Conti** ransomware across the victim’s Windows network. The encryption phase was executed through batch scripts run from four servers, and the intrusion closely matched tactics documented in leaked Conti affiliate playbooks, underscoring how outdated Exchange cumulative updates left the organization exposed.
Aug 15, 2026
A large-scale campaign dubbed **FortiBleed** harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as **FortiGate Sniffer**, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as `adminin`. Open-source reporting and government alerts also tied the activity to Fortinet flaws including `CVE-2024-55591`, `CVE-2025-59718`, and `CVE-2025-59719`, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity. The stolen access was allegedly linked to the **INC** and **Lynx** ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Aug 15, 2026