Conti
Conti is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019.Conti has been deployed viaTrickBot and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors usingConti steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.[1][2][3]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter:Windows Command Shell | Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.[2][4] |
| Enterprise | T1486 | Data Encrypted for Impact | Conti can use | |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Conti has decrypted its payload using a hardcoded AES-256 key.[1][2] | |
| Enterprise | T1083 | File and Directory Discovery | ||
| Enterprise | T1490 | Inhibit System Recovery | Conti can delete Windows Volume Shadow Copies using | |
| Enterprise | T1106 | Native API | ||
| Enterprise | T1135 | Network Share Discovery | Conti can enumerate remote open SMB network shares using | |
| Enterprise | T1027 | Obfuscated Files or Information | Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.[2][1][5] | |
| Enterprise | T1057 | Process Discovery | Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.[2] | |
| Enterprise | T1055 | .001 | Process Injection:Dynamic-link Library Injection | Conti has loaded an encrypted DLL into memory and then executes it.[1][2] |
| Enterprise | T1021 | .002 | Remote Services:SMB/Windows Admin Shares | Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.[1][2] |
| Enterprise | T1018 | Remote System Discovery | Conti has the ability to discover hosts on a target network.[5] | |
| Enterprise | T1489 | Service Stop | Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of | |
| Enterprise | T1016 | System Network Configuration Discovery | Conti can retrieve the ARP cache from the local system by using the | |
| Enterprise | T1049 | System Network Connections Discovery | Conti can enumerate routine network connections from a compromised host.[2] | |
| Enterprise | T1080 | Taint Shared Content | Conti can spread itself by infecting other remote machines via network shared drives.[1][2] | |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0102 | Wizard Spider |
Campaigns
References
- Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.
- Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
- Cybleinc. (2021, January 21). Conti Ransomware Resurfaces, Targeting Government & Large Organizations. Retrieved April 13, 2021.
- DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
- Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.
- Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.
- Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.