Conti

Conti was a Russian-speaking cybercriminal ransomware operation active from 2020 until its 2022 collapse, widely regarded as one of the most prolific double-extortion groups of its period and often described as a successor to Ryuk. The group combined targeted network intrusions, large-scale data theft, and rapid multithreaded file encryption, then pressured victims through leak-site publication threats and aggressive negotiation tactics. Conti publicly aligned itself with Russia during the early phase of the Russia-Ukraine war, after which internal chat logs and training materials were leaked, exposing the group’s organization, tooling, and affiliate tradecraft. Conti’s operations relied on an ecosystem of affiliates, access brokers, and malware partnerships. Reported access vectors and enabling malware included TrickBot, BazarLoader, QakBot, IcedID, Emotet, phishing, exposed RDP, VPN weaknesses, and exploitation of vulnerable internet-facing systems. Once inside victim environments, Conti operators and affiliates commonly used Cobalt Strike for post-exploitation, conducted credential theft and Active Directory compromise, escalated privileges, moved laterally with administrative tools and remote execution methods, exfiltrated data with tools such as Rclone and later Exmatter in some observed cases, and disabled defenses and recovery mechanisms including shadow copies and security tooling. The Conti ransomware payload itself used layered in-memory execution with shellcode and reflective loading, encrypted APIs and strings, anti-analysis logic, mutex-based execution control, and operator command-line options. It encrypted files with ChaCha8 and protected per-file key material with an embedded RSA public key. The malware could target local systems, accessible network shares, and remote hosts over SMB, while also using Windows Restart Manager to close locking applications and WMI to delete shadow copies. Conti was not a worm, but it supported operator-driven network-wide encryption at scale. Victimology spanned a broad set of sectors and countries, including healthcare, education, financial organizations, IT services, legal, charitable, food manufacturing, pharmaceuticals, logistics, oil-related entities, and other enterprises and public-facing organizations. The group was associated with more than 30 observed victim postings per month on average in 2021 and at one point accounted for roughly a quarter of surveyed leak-site victims among major ransomware groups. Conti maintained internal manuals for affiliates covering reconnaissance, scanning, SMB brute forcing, Kerberoasting, privilege escalation, domain takeover, NTDS dumping, persistence, defense evasion, and data exfiltration. Leaked materials and subsequent reporting also tied the broader Conti ecosystem to extortion-only activity through Karakurt, which was described as Conti’s extortion arm before Conti ceased operations. After the group’s disintegration in 2022, researchers and industry reporting linked former members or successor elements to later operations including Royal and Black Basta.