HackerFeeds
All ransomware groups

conti

351 tracked victims
·first seen 2020-07-31·last activity 2022-06-07

Activity analysis

HackerFeeds has tracked 351 victims claimed by conti since July 2020, most recently in June 2022 — ranking #21 of 332 groups (1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in June 2022. Its most-targeted sector is Manufacturing (83 victims), followed by Business Services (57). The United States accounts for 12 victims (63% of those with a known location); 332 victims did not disclose a location.

Victims per year

  • 202011
  • 2021180
  • 2022160

Top sectors

  • Manufacturing83
  • Business Services57
  • Consumer Services29
  • Construction18
  • Technology17
  • Agriculture and Food Production17

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1078.002Valid Accounts: Domain Accounts

    Use of credentials purchased via Initial Access Brokers or harvested through prior compromises.

  • T1190Exploit Public-Facing Application

    Exploitation of Log4Shell (CVE-2021-44228), ProxyShell, and Fortinet vulnerabilities to gain initial access to victim networks.

  • T1566.001Phishing: Spearphishing Attachment

    Conti extensively uses BazarLoader and TrickBot delivered via spear-phishing emails with malicious Office document attachments containing macros.

TA0002

Execution

  • T1047Windows Management Instrumentation

    WMI leveraged for remote command execution across victim infrastructure.

  • T1059.001Command and Scripting Interpreter: PowerShell

    PowerShell used extensively for payload deployment, Cobalt Strike beacon staging, and post-exploitation activity.

TA0003

Persistence

  • T1136.002Create Account: Domain Account

    New domain accounts created for persistent access and to facilitate lateral movement with elevated privileges.

  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys

    Registry Run keys used to maintain persistence of backdoor tools across reboots.

TA0004

Privilege Escalation

  • T1068Exploitation for Privilege Escalation

    Exploitation of PrintNightmare (CVE-2021-34527) and ZeroLogon (CVE-2020-1472) to escalate to SYSTEM or Domain Admin.

TA0005

Defense Evasion

  • T1218.011Signed Binary Proxy Execution: Rundll32

    Rundll32 used to execute malicious DLLs and evade application control.

  • T1562.001Disable or Modify Tools

    Windows Defender, AV products, and EDR tools disabled via PowerShell, registry modification, or Group Policy Objects.

TA0006

Credential Access

  • T1003.001OS Credential Dumping: LSASS Memory

    Mimikatz used to dump LSASS memory for credential harvesting across compromised hosts.

  • T1003.003OS Credential Dumping: NTDS

    Active Directory NTDS.dit extracted to obtain all domain account password hashes.

TA0007

Discovery

  • T1046Network Service Discovery

    Network scanning using Nmap, SoftPerfect Network Scanner, and custom scripts to enumerate the internal network.

  • T1482Domain Trust Discovery

    BloodHound used to enumerate Active Directory and identify attack paths to high-value targets.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement using harvested credentials across the victim network.

  • T1021.002Remote Services: SMB/Windows Admin Shares

    PsExec used to deploy Cobalt Strike beacons and the ransomware payload across the network.

TA0009

Collection

  • T1005Data from Local System

    Sensitive documents, financial records, and PII collected from compromised hosts prior to encryption.

  • T1560.001Archive Collected Data: Archive via Utility

    7-Zip used to compress and archive stolen data for exfiltration.

TA0010

Exfiltration

  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Rclone used to exfiltrate stolen data to MEGA and other cloud storage providers as part of the double extortion model.

TA0011

Command and Control

  • T1071.001Application Layer Protocol: Web Protocols

    Cobalt Strike beacons communicate via HTTPS to actor-controlled team servers for C2 operations.

  • T1219Remote Access Software

    AnyDesk and Atera agent installed as persistent backdoors for remote access.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Conti ransomware uses ChaCha20 for file encryption with RSA-4096 for key protection. Multi-threaded encryption leverages up to 32 simultaneous threads for rapid encryption. Operates as RaaS.

  • T1490Inhibit System Recovery

    Volume Shadow Copies deleted via vssadmin and wmic; Windows Backup Catalog deleted; recovery mode disabled via bcdedit.

Recent victims

No victims tracked yet.