Conti
Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
Victims
351
First Victim
2020-07-31
(est. attack date)
Discovery Date
2020-07-31
Last Seen
2022-06-07
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
100.0%
victims with domain
Countries
6
hit
Uptime
73.8% avg (30d)
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
CONTI.News | No | 2026-08-22T08:42:44 |
continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion
|
||||
|
continews.click | 522: Connection timed out | No | 2026-09-06T15:07:09 |
continews.click
|
||||
|
Error Response Page | No | 2026-08-22T08:42:37 |
continews.bz
|
Target
Top 5 Activity Sectors
- Manufacturing 91
- Professional Services 61
- Retail & E-Commerce 30
- Technology 20
- Healthcare 19
Top 5 Countries
-
United States
12
-
Italy
2
-
Canada
2
-
Thailand
1
-
Ireland
1
Heatmap
Ransom Notes (4)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
AdFind
Bloodhound
PowerView
Seatbelt
ShareFinder
SharpView
SoftPerfect NetScan
|
AnyDesk
Atera
Splashtop
|
GMER
PCHunter
|
Mimikatz
ProcDump
Router Scan
SharpChrome
|
Cobalt Strike
Metasploit
Meterpreter
PowerShell Empire
PowerSploit
Rubeus
|
|
BITSAdmin
NTDS Utility (ntdsutil)
PsExec
WMIC
|
Dropfiles
MEGA
Qaz[.]im
RClone
Sendspace
WinSCP
|
TTPs Matrix (12)
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts: Domain Accounts | Windows Management Instrumentation | Create Account: Domain Account | Exploitation for Privilege Escalation | Signed Binary Proxy Execution: Rundll32 | OS Credential Dumping: LSASS Memory | Network Service Discovery | Remote Services: Remote Desktop Protocol | Data from Local System | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Application Layer Protocol: Web Protocols | Data Encrypted for Impact |
| Exploit Public-Facing Application | Command and Scripting Interpreter: PowerShell | Boot or Logon Autostart Execution: Registry Run Keys | Disable or Modify Tools | OS Credential Dumping: NTDS | Domain Trust Discovery | Remote Services: SMB/Windows Admin Shares | Archive Collected Data: Archive via Utility | Remote Access Software | Inhibit System Recovery | ||
| Phishing: Spearphishing Attachment |
KQL Query (2)
-
Conti – PowerView/SharpView Domain-Trust Enumeration
Discovery
Sentinel
T1482 -
Conti – Rubeus Kerberos Abuse Followed by PsExec Lateral Movement
Lateral Movement
Sentinel
T1021.002
Negotiation Chats (32)
20201017
78 msgs
20201019
9 msgs
20201109
255 msgs
20201121
6 msgs
20201230
146 msgs
20210107
139 msgs
20210126
9 msgs
20210219
12 msgs
20210305
45 msgs
20210315
49 msgs
20210316
63 msgs
20210426
12 msgs
20210428
13 msgs
20210513
78 msgs
20210517
56 msgs
20210517_b
69 msgs
20210520
101 msgs
20210602
81 msgs
20210611
48 msgs
20210628
34 msgs
20210708
25 msgs
20210715
10 msgs
20210805
47 msgs
20210812
46 msgs
20210820
50 msgs
20210902
43 msgs
20210904
17 msgs
20210923
14 msgs
20211108
32 msgs
20211112
32 msgs
20211205
63 msgs
20211217
27 msgs
YARA Rules (4)
Cryptomoney (103)
Victims (351)
No description available