Loading malware…
Conti is a Windows ransomware family first observed in 2020 and widely associated with targeted, double-extortion intrusions. Operators used it to encrypt victim systems while also threatening to publish stolen data, and the malware became one of the most prominent enterprise-focused ransomware strains of its period. Conti has been linked operationally to intrusion chains involving malware such as TrickBot and QakBot and is often discussed as part of the broader Wizard Spider ecosystem and as a successor to Ryuk in some reporting. Following leaks of Conti’s internal communications and source code in 2022, the operation declined, but its codebase influenced later ransomware variants and successor groups.
Technically, Conti is designed for fast, operator-driven encryption on Windows environments. Analyses describe a layered in-memory execution chain using shellcode and reflective loading, along with encrypted strings, encrypted API resolution, and other anti-analysis measures intended to hinder reverse engineering and dynamic inspection. It supports command-line options for manual deployment, uses mutex-based single-instance control, and employs multithreading to accelerate encryption. Conti encrypts files with per-file symmetric keys and protects those keys with an embedded asymmetric public key. It also uses Windows Restart Manager to close applications locking targeted files, drops ransom notes, and deletes volume shadow copies to inhibit recovery.
Conti also supports encryption of accessible network resources. It can enumerate processes, discover local network information such as the ARP cache, identify reachable hosts and SMB shares, and encrypt files on remote systems and shared drives when access is already available. This behavior enables rapid impact across enterprise networks, although it is distinct from autonomous worm propagation. Reported victim environments commonly involved prior compromise through exposed remote access services, vulnerable internet-facing systems, or stolen credentials. Conti affected organizations globally across multiple sectors and remains significant both for its operational impact and for the downstream reuse of its leaked code in later ransomware development.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
32 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
Conti ransomware is a global threat affecting victims mainly in North America and Western Europe.
...brute-force routers, NAS devices, and security cameras use the ZeroLogon exploit perform a Kerberoasting attack...
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The initial remote code execution vulnerability (CVE-2021-44228) has been dubbed Log4Shell... The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti. | The vulnerability has been exploited to deploy a plethora of payloads like coin miners, Dridex malware, and even ransomware such as Conti.
They check for the “PrintNightmare” vulnerability (CVE-2021-34527) in Windows Print spooler service, EternalBlue vulnerability (CVE-2017-0144) in Microsoft Windows Server Message Block, and the “Zerologon” vulnerability (CVE-2020-1472) in Microsoft Active Directory Domain Controller. | Conti is a sophisticated Ransomware-as-a-Service (RaaS) model first detected in December 2019.
They check for the “PrintNightmare” vulnerability (CVE-2021-34527) in Windows Print spooler service, EternalBlue vulnerability (CVE-2017-0144) in Microsoft Windows Server Message Block, and the “Zerologon” vulnerability (CVE-2020-1472) in Microsoft Active Directory Domain Controller. | Conti is a sophisticated Ransomware-as-a-Service (RaaS) model first detected in December 2019.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
Intel-SA-00307 CSME versions before 12.0.49 (IOT only: 12.0.56), 13.0.21, 14.0.11. CVE-2019-14598 Local privilege escalation
Intel-SA-00185 CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 CVE-2018-12196 CVE-2018-12200 CVE-2018-12190 Local execution of arbitrary code and local privilege escalation.
Intel-SA-00112 Manageability Engine Firmware version 3.x,4.x,5.x,6.x,7.x,8.x,9.x, 10.x,11.x CVE-2018-3628 RCE on same subnet
Intel-SA-00391 CSME and AMT versions before 11.8.82, 11.12.82, 11.22.82, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 NPE: CVE-2020-8752 LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760 Unauthenticated network privilege escalation. Local privilege escalations.
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00086 ME – 6.x/7.x/8.x/9.x/10.x//11.0/11.5/11.6/11.7/11.10/11.20 CVE-2017-5705 CVE-2017-5711 CVE-2017-5712
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
Intel-SA-00459 CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 CVE-2020-8703 Local privilege escalation
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00295 ... LPE: CVE-2020-0586 CVE-2020-0542 CVE-2020-0533 CVE-2020-0541
Intel-SA-00391 ... LPE: CVE-2020-12297 CVE-2020-12303 CVE-2020-12354 CVE-2020-8744 CVE-2020-8757 CVE-2020-8756 CVE-2020-8760
Intel-SA-00213 CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 CVE-2019-0091 CVE-2019-0086 CVE-2019-0153 CVE-2019-0096 Unprivileged user privilege escalation and network privilege escalation.
Intel-SA-00185 CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 CVE-2018-12196 CVE-2018-12200 CVE-2018-12190 Local execution of arbitrary code and local privilege escalation.
Intel-SA-00241 AMT versions 11.0 thru 11.8.65, 11.10 thru 11.11.65, 11.20 thru 11.22.65, 12.0 thru 12.0.35, 13.0, 14.0.0 LPE: CVE-2019-11147 CVE-2019-11105 CVE-2019-11104 CVE-2019-11097 CVE-2019-11103 CVE-2019-11087 CVE-2019-11106 CVE-2019-11110 CVE-2019-11108 APE: CVE-2019-0169 CVE-2019-11088 NPE:CVE-2019-11132 CVE-2019-11131 CVE-2019-11107
28 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
Conti cyberthreat actors remain active and Conti ransomware attacks against U.S. and international organizations have risen to more than 1,000. Notable attack vectors include Trickbot and Cobalt Strike.
The Conti Group is renowned for being a very successful Ransomware operator and the gang have terrorized businesses worldwide by encrypting their networks for a ransom and also threatening to leak data if not paid.
Based on data from the leak sites of their operators, 35.8% of these attacks were attributed to LockBit, while 19% belonged to Conti and 9.6% to BlackCat.
We noticed that only certain affiliates have access to a Linux variant of the Conti ransomware, targeting ESXi systems.
The TrickBot Gang... commonly leading to Conti and Ryuk ransomware attacks... The researchers saw both Diavol and Conti ransomware payloads deployed on a network in the same ransomware attack in early June 2021.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
ファイルレスとなるReflective PE Injectionを複数使用した解析検知妨害や、動作中に使用する全ての文字列やAPIに暗号化を施すなど...
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Conti has loaded an encrypted DLL into memory and then executes it.
Contiランサムウェアは、動作中に使用する全てのWindows APIを暗号化しています。...使用するたびに必要なWindows APIのアドレスを復号した上で呼び出します。...文字列ごとに用意された関数で使うたびに復号して使用します。
このシステムファイルへの属性変更処理は通常のWindows環境であれば常に失敗する処理となります。...属性変更処理が"成功した場合"のみ自身を終了し、"失敗した場合"のみ自身を継続する処理に遷移します。
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
ARP解決できるIPアドレスが存在した場合、445番ポートへSMBプロトコルで疎通確認を行い、アクセスできる端末やフォルダが見つかった場合...
Conti can enumerate routine network connections from a compromised host.
RmGetList関数を呼び出すことで該当ファイルを使用中のアプリケーション情報をWindowsOSから得ることができます。その後、Contiはファイルを使用中のアプリケーションがexplorer.exeの場合のみ例外的に強制終了から除外...
Contiランサムウェアは暗号化対象端末を選定し暗号化していきます...FindFirst/FindNextFileなどの一般的なファイル操作関数を用いてローカルファイルと同じように探索し暗号化していきます。
Contiランサムウェアは同一ネットワーク上の共有フォルダやネットワーク上の他の端末のファイルを暗号化する能力を持っている...アクセスできる端末やフォルダが見つかった場合...探索し暗号化していきます。
only certain affiliates have access to a Linux variant of the Conti ransomware, targeting ESXi systems | they try to encrypt as many systems as possible
This flag allows the ransomware to kill those processes that have the selected files for encryption | kills the “lsass” process to reboot the infected machine
188 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conti is a ransomware operation that used TrickBot-provided initial access and remote footholds to compromise networks, gain administrative control, steal data, and deploy ransomware at scale. The article emphasizes its close operational alignment with TrickBot and its in-house, tightly controlled intrusion model.
Ransomware family mentioned as an example of poor criminal operational security and leaked internal communications; not part of the primary Kaseya incident.
Referenced as the ransomware family whose leaked source code Gunra was derived from.
Ransomware operation/RaaS platform whose leaked source code later influenced other ransomware families.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.