Conti

Conti was a prolific and notoriously well-organized ransomware group active from 2020 until it ceased operating under its original name in 2022. The group conducted ransomware and double-extortion operations, breaching victim networks, encrypting files, stealing data, and threatening public disclosure unless ransoms were paid. Court documents and reporting in the provided content state that Conti targeted more than 1,000 victims worldwide between 2020 and 2022, including victims across 47 U.S. states, Puerto Rico, the District of Columbia, and 31 countries, and that the FBI estimated at least $150 million in ransom payments by January 2022. Reported victim sectors included healthcare organizations, government agencies, educational institutions, and businesses. The group was publicly noted for announcing full support for the Russian government in 2022, after which internal leaks contributed to its shutdown. The content describes Conti as closely linked to the TrickBot malware operation and notes reporting suggesting ties to Russian intelligence and political patrons, though those links are described as reporting and leaked-chat indications. Leaks also revealed an organizational structure resembling a legitimate company, including middle management and a human resources department. Observed or reported tradecraft in the provided content includes use of PsExec for ransomware propagation, use of Tor infrastructure, development of a malware loader by a member, and ESXi/Linux locker development with overlaps to leaked Babuk and Windows Conti code. The content also notes that former Conti members or core teams are believed to have moved into or influenced later operations including Black Basta, Royal/BlackSuit/3AM, and other cybercrime activity. Known alias in the provided content: conti.