Loading story…
Conti emerged as one of the most active ransomware-as-a-service operations, using spearphishing, exposed RDP, and loaders such as BazarLoader, TrickBot, IceID, and Emotet to gain access before deploying Cobalt Strike, stealing data, and encrypting systems across networks. Security reporting tied the group to more than 400 attacks globally, with victims concentrated in North America and Europe, and described technical tradecraft including credential attacks, shadow copy deletion, service termination, remote SMB encryption, and ransom notes named CONTI_README.txt. In industrial environments, Dragos said ransomware became the leading cause of compromises in 2021, with Conti and LockBit 2.0 accounting for more than half of observed incidents, while suspected Conti-linked activity was later detected at major automotive manufacturers and suppliers in North America and Japan.
Leaked internal chats, source code, and infrastructure data exposed Conti as a highly organized criminal business rather than a loose affiliate network. Researchers identified a core group of roughly 44 members within a wider set of 442 chat handles, with dedicated teams for coding, reverse engineering, OSINT, HR, payroll, and a "Fire Team" that conducted victim research, built phishing phone and email scripts, and helped pressure victims during ransom negotiations using tools such as Shodan, SpiderFoot, SignalHire, and ZoomInfo. The group’s impact was illustrated by the attack on Ireland’s Health Service Executive, where about 80% of IT systems were encrypted, roughly 700 GB of data was stolen, and healthcare services were disrupted nationwide before Conti offered a free decryptor while still demanding a $20 million ransom and threatening to leak the data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Dragos reported sustained communications from December 2021 through March 2022 between Emotet command-and-control infrastructure and multiple automotive-sector organizations in North America and Japan, which it assessed were likely linked to Conti operations.
Arctic Wolf said the Conti ransomware group posted a public statement supporting Russia, a move that preceded the major leak of its internal data.
On February 3, 2022, the U.S. Department of Health and Human Services published a threat brief describing the 2021 Conti attack on Ireland's Health Service Executive, including that 80% of its IT systems were encrypted and about 700 GB of data was stolen.
Qualys said CISA and the FBI issued a warning in September 2021 stating they had observed Conti used in more than 400 cyberattacks globally, concentrated in North America and Europe.
The DFIR Report described an early-August 2021 intrusion in which attackers used phishing-delivered BazarLoader, Cobalt Strike, lateral movement, and rclone exfiltration to MEGA before deploying Conti ransomware on day five to encrypt most domain-joined systems. The report also published technical indicators and detection content, including C2 infrastructure, hashes, JA3/JA3s, and Suricata, Sigma, and YARA rules.
Leaked Conti information analyzed by Intel 471 showed that an internal division called the Fire Team started in July 2021 to create phishing call cover stories and randomize spam letters for prospective victims.
SophosLabs added a "Ransomware-Conti.csv" file to its IoC repository with domains, IPs, URL paths, and file hashes associated with Conti activity, including Cobalt Strike infrastructure and a hash for the conti.exe payload. The IoC set was tied to a Sophos report on Conti ransomware.
Qualys reported that the Conti ransomware-as-a-service operation was first detected in December 2019 and rapidly grew after its emergence, displacing other tools such as Ryuk.
Intel 471 analyzed leaked Conti communications and described the Fire Team as an internal business-intelligence and sales-like unit that gathered reconnaissance, developed phishing scripts, and participated in ransom negotiations.
Arctic Wolf published analysis of the leaked Conti materials, concluding the group operated as a structured organization with a core group of about 44 members inside a broader network of 442 chat handles.
After Conti's pro-Russia statement, an actor using the @ContiLeaks handle published leaked internal Jabber chats, infrastructure details, internal documents, and source code, accompanied by the phrase "Glory to Ukraine."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourcearcticwolf.com
Open sourcedragos.com
Open sourcebleepingcomputer.com
Open sourcecarbonblack.com
Open sourcehub.dragos.com
Open sourcecybereason.com
Open sourcecybleinc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026
The **Conti** ransomware syndicate took key parts of its digital infrastructure offline, including sections of its leak site, victim negotiation portal, and internal systems, in what researchers described as a deliberate reorganization rather than a direct law-enforcement takedown. Security firms and reporting tied the move to mounting pressure after a pro-Ukraine insider leaked Conti’s internal chats and tools, exposing the group’s structure, workflows, and links to Russia. The leaks followed Conti’s public declaration of support for Russia after the invasion of Ukraine, a stance that triggered internal backlash and gave investigators an unusually detailed view into one of the world’s most prolific ransomware operations. Researchers said Conti’s shutdown did not mark the end of its activity but a **rebranding and dispersal of personnel** into smaller, harder-to-track units and other extortion groups, including operations such as **ALPHV/BlackCat**. Subsequent reporting indicated former Conti members continued to repurpose the gang’s tooling in campaigns tied to Ukraine, including lures exploiting the **Follina** vulnerability and impersonation themes involving Elon Musk. The episode also underscored why sanctions and disruption efforts struggle to permanently dismantle ransomware groups: even when a major brand collapses, its operators, malware, and playbooks often persist across successor crews.
Jun 29, 2026