Loading story…
Internal documentation leaked by a self-described Conti penetration tester exposed how the ransomware group guided affiliates through reconnaissance, credential theft, privilege escalation, persistence, lateral movement, data exfiltration, and encryption. FortiGuard Labs and ReliaQuest described instructions to exploit Zerologon and PrintNightmare, pursue privileged administrator accounts, maintain access through remote-access tools, and blend into legitimate administrative activity to avoid detection. Operators assessed victims’ revenue and searched for financial records, cybersecurity insurance policies, backups, and hypervisors to strengthen ransom demands and maximize disruption.
The manuals described using rclone and MEGA to exfiltrate data before encryption, supporting Conti’s theft-and-encryption extortion model. They also referenced Linux and VMware ESXi encryption capabilities, although FortiGuard had not observed those variants in the wild when its August 2021 report appeared. ReliaQuest’s June 2022 analysis noted that Conti had shut down operations in May 2022 and recommended least privilege, credential auditing, process-hierarchy monitoring, enhanced PowerShell auditing, and detection of suspicious Volume Shadow Copy access to counter the documented techniques.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Conti shut down its operations in May 2022, according to ReliaQuest's analysis of the gang's leaked attack materials.
A self-described Conti penetration tester publicly leaked password-protected archives, operational instructions, and reference files intended for affiliates. The materials exposed the gang's workflow for reconnaissance, credential theft, persistence, data exfiltration, and ransomware deployment.
FortiGuard Labs analyzed the leaked “CobaltStrike Manuals_V2 Active Directory” manual, detailing exploitation of Zerologon and PrintNightmare, remote-access persistence, and exfiltration through MEGA and Rclone. The manual also documented Linux and VMware ESXi encryption capabilities that the researchers had not observed in the wild.
A Conti ransomware attack disrupted Irish Health Service operations and reportedly involved the exfiltration of more than 700 GB of personally identifiable information and database data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal chats, playbooks, and malware samples exposed **Conti** as a highly structured ransomware enterprise that combined mature intrusion operations with ongoing development of new attack paths. Reporting on the leaks showed the group maintained specialized teams for coding, testing, administration, reverse engineering, and intrusions, relied on **Trickbot** and **Emotet** infrastructure, and provided affiliates with detailed guidance for enterprise compromise. The leaked playbook documented heavy use of **Cobalt Strike**, **AdFind**, **SharpView**, **SharpChrome**, **SeatBelt**, and **GMER**, along with credential theft, Active Directory reconnaissance, administrator targeting, and exploitation of **`CVE-2020-1472`** to accelerate domain-wide access.
Aug 15, 2026
A disgruntled Conti affiliate leaked the gang’s internal training manuals on the XSS cybercrime forum, exposing how affiliates were taught to breach corporate networks, move laterally, escalate privileges, exfiltrate data, and deploy ransomware. The archive reportedly contained 37 text files covering common intrusion tooling such as **Cobalt Strike**, **Rclone**, **AnyDesk**, **Metasploit**, **Ngrok**, and **NetScan**, along with guidance for **NTDS** dumping, **Kerberoasting**, **SMB** brute forcing, and exploitation of **Zerologon** (`CVE-2020-1472`) to obtain domain-level access. The leaks later expanded beyond operational manuals to include source code for two **TrickBot** components—the **Command Dispatcher** and **Data Collector**—as well as the reported doxxing of a Conti developer. Although much of the exposed material reflected known ransomware tradecraft rather than novel techniques, the disclosures provided defenders with rare visibility into Conti’s affiliate operations, tooling, and procedures, helping organizations refine detections and response playbooks against Conti- and TrickBot-linked intrusions.
Aug 15, 2026
Leaked Conti communications and ransomware source code exposed the Russian-speaking group’s internal operations after it declared support for Russia’s invasion of Ukraine in 2022. A Ukrainian cybersecurity researcher released 60,694 messages across 393 JSON files, which other researchers subsequently validated. ReliaQuest found a structured organization with persistent leadership, defined employment practices, and communications concentrated among a small number of users. Messaging dropped substantially on weekends and correlated with newly reported victims, but those patterns do not establish when attacks occurred; explanations for individual activity spikes remain speculative. Tenable identified more than 30 vulnerabilities associated with Conti and its affiliates, with privilege-escalation flaws accounting for nearly three quarters of those disclosed in the communications. The group combined multiple initial-access methods with post-compromise techniques aimed at obtaining domain administrator privileges and encrypting systems across victim networks. Most listed vulnerabilities already had patches available, underscoring the need to address both internet-facing exposure and internal escalation paths. MITRE’s separate reporting identifies AdFind as an Active Directory reconnaissance utility used by numerous intrusion sets, including Wizard Spider, reinforcing the importance of monitoring directory enumeration alongside privilege escalation rather than relying on perimeter defenses alone.
Oct 9, 2026