Home

Conti Ransomware

Ransomware (RaaS) · First seen December 2019 · Disbanded May 2022 · Legacy active via successor groups · Last updated June 29, 2026

Overview

Conti is a human operated ransomware family operated as ransomware-as-a-service by the Russia-based threat group tracked as Wizard Spider. First observed in December 2019, it evolved directly from the Ryuk ransomware codebase and rapidly became one of the most destructive and financially prolific ransomware operations on record. Between 2020 and May 2022, the group recorded an estimated $180 million in annual revenue at peak, with the FBI estimating cumulative payments exceeding $150 million across more than 1,000 confirmed victims.

Conti differs from most RaaS operations in how it compensated its workforce. Rather than splitting ransom proceeds with affiliates on a percentage basis, Conti paid operators fixed monthly wages, structuring itself more like a corporation than a criminal collective. Leaked internal communications from February 2022 revealed an organization of approximately 62 to over 100 personnel with dedicated roles spanning development, penetration testing, negotiation, and human resources.

The group's attack model combined established malware delivery infrastructure with hands-on post-exploitation. Initial access arrived through TrickBot and BazarLoader infections, which were used to stage Cobalt Strike beacons. From there, operators conducted Active Directory reconnaissance, harvested credentials using Mimikatz and related tooling, moved laterally via RDP and SMB, exfiltrated data using Rclone, then deployed Conti's multi-threaded encryption payload across the domain. The full chain from initial access to domain-wide encryption was documented in incidents lasting as few as 32 hours.

In February 2022, following Russia's invasion of Ukraine, Conti publicly announced its support for the Russian government. A Ukrainian affiliate responded by leaking over 60,000 internal chat messages, technical manuals, and source code. The reputational and operational damage was severe. Victims stopped paying, and the brand became a liability. By May 2022, Conti's infrastructure, including its leak site and negotiation portals, had been shut down. The group did not disappear. Its operators redistributed into successor groups including Black Basta, Karakurt, BlackByte, Royal, and Akira, carrying the same tooling, playbooks, and personnel. Those groups remain active.

CISA and the FBI jointly issued an advisory on Conti in September 2021, updated through March 2022, documenting over 400 attacks against US and international organizations. In September 2023, the US Department of Justice indicted four Russian nationals for their roles in the operation. A loader developer, Oleksii Lytvynenko, pleaded guilty in 2026 under FBI Operation Riptide.

Operational attack chain · TrickBot/BazarLoader-to-Conti
  1. Start

    Initial access

    Phishing email · malicious attachment · stolen RDP credentials · exploit (ProxyShell / Zerologon / FortiGate)

  2. Stage 1

    Loader execution

    TrickBot or BazarLoader establishes first-stage foothold and C2 channel

  3. Stage 2

    Cobalt Strike beacon deployed

    Loader fetches Cobalt Strike · operator takes hands-on control

  4. Stage 3

    Reconnaissance and credential harvesting

    nltest · net · whoami · BloodHound · Mimikatz · Kerberoasting

    AD discoveryLSASS dumpPass-the-hash
  5. Stage 4

    Lateral movement to domain controller

    RDP with harvested credentials · PsExec · SMB · AnyDesk persistence

  6. Stage 5

    Data exfiltration

    Rclone syncs sensitive files to attacker-controlled cloud storage (MEGA · Dropbox)

  7. Stage 6

    Pre-encryption preparation

    net stop terminates 146 services · VSS deleted · Windows Defender disabled

  8. Impact

    Domain-wide encryption + double extortion

    PsExec or WMIC deploys Conti across all joined hosts · CONTI_README.txt dropped · leak site activated

The dwell time between initial BazarLoader execution and ransomware deployment ranged from 32 hours to several weeks in documented incidents. Operators used the dwell period to maximize AD access, complete exfiltration, and identify high value servers before triggering encryption.

Tactics, techniques, and procedures

Conti's technique density is highest in Lateral Movement, Credential Access, and Impact. Its post-exploitation phase is hands-on and systematic operators enumerate, elevate, and pivot before any encryption occurs. The kill chain covers at least 11 of 14 MITRE ATT&CK enterprise tactics.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev1Initial Access3Execution2Persistence2Priv. Esc3Defense Evasion3Credential Access3Discovery4Lateral3Collection1C22Exfiltration1Impact3
Technique detailKey techniques · Conti Ransomware
TacticTechniquesWhat Conti does
Initial Access
Spearphishing Attachment T1566.001Spearphishing Link T1566.002Valid Accounts T1078Exploit Public-Facing App T1190
Phishing emails deliver malicious Office attachments or links that stage TrickBot or BazarLoader. Stolen or brute-forced RDP credentials are also a documented primary vector. Operators have exploited ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), Zerologon (CVE-2020-1472), and FortiGate vulnerabilities (CVE-2018-13379) for direct network access.
Execution
Windows Command Shell T1059.003Native API T1106
Conti accepts command-line arguments that control encryption scope (--encrypt-mode all/local/network) and target host lists (-h). Ransomware deployment across the domain uses WMIC remote process creation or PsExec with batch files. The encryption engine calls Windows I/O Completion Port APIs (CreateIoCompletionPort, PostQueuedCompletionStatus, GetQueuedCompletionStatus) to drive 32 concurrent encryption threads.
Persistence
External Remote Services T1133Valid Accounts T1078
Operators install AnyDesk or Atera remote management software on compromised hosts to maintain a persistent, out-of-band access channel that survives antivirus remediation of the original loader. Stolen domain credentials allow re-entry via RDP or VPN independently of any malware artifact.
Privilege Escalation
DLL Injection T1055.001Exploitation for Priv Esc T1068Access Token Manipulation T1134
Conti loads an encrypted DLL into memory and executes it to achieve initial privilege elevation. Operators exploit PrintNightmare (CVE-2021-34527), Zerologon (CVE-2020-1472), and EternalBlue (CVE-2017-0144) for domain privilege escalation. RouterScan is used to brute-force router and NAS credentials for additional footholds.
Defense Evasion
Obfuscated Files T1027Deobfuscate / Decode T1140Disable Security Tools T1562.001
The Conti payload is delivered as an encrypted DLL decoded at runtime using a hardcoded AES-256 key. Conti's binary hashes Windows API names with the Murmur2A algorithm and loads them dynamically, making static import analysis ineffective. Before encryption, operators disable Windows Defender and stop 146 Windows services covering security, backup, SQL, and email solutions using net stop commands. Shadow copies are deleted via vssadmin or WMI.
Credential Access
LSASS Memory T1003.001Kerberoasting T1558.003Brute Force T1110
Mimikatz is used to extract plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory. Invoke-MassMimikatz and the comsvcs DLL MiniDump function are alternative LSASS dump methods documented in Conti's leaked playbook. Kerberoasting extracts service account hashes for offline cracking. RouterScan brute-forces network device credentials. reg save commands export the SAM and SYSTEM hives for offline credential extraction.
Discovery
System Information T1082Network Config Discovery T1016Network Share Discovery T1135Process Discovery T1057
Operators use nltest /domain_trusts, net view, and BloodHound to map Active Directory topology and identify domain controllers, backup servers, and high-value targets. Conti's encryption payload calls GetIpNetTable() to retrieve the ARP cache and identifies local network ranges (172.x, 192.168.x, 10.x) for SMB share enumeration via NetShareEnum(). Process enumeration searches specifically for SQL-related process names to prioritize those servers for encryption.
Lateral Movement
SMB/Windows Admin Shares T1021.002Remote Desktop Protocol T1021.001Taint Shared Content T1080
Operators pivot to domain controllers and additional servers via RDP using harvested credentials. Cobalt Strike beacons facilitate additional lateral movement. The ransomware payload spreads autonomously over SMB to accessible network shares, encrypting files on remote hosts in addition to the local system. WMIC remote process creation (wmic /node:"HOST" process call create) is used for controlled ransomware deployment across targeted endpoints.
Collection
Local System Data T1005
Operators stage sensitive files for exfiltration before triggering encryption. Targeted data includes financial records, personally identifiable information, internal documents, and operational data. This pre-encryption collection is the foundation of the double extortion model.
Command and Control
Web Protocols T1071.001Remote Access Software T1219
Cobalt Strike beacons communicate over HTTPS to operator-controlled C2 servers with malleable profiles. AnyDesk and Atera provide secondary remote access channels independent of the Cobalt Strike infrastructure. The CISA advisory documented four Cobalt Strike C2 IPs from Conti's leaked playbook, with operators using unique IPs per victim organization.
Exfiltration
Exfiltration to Cloud T1567.002
Rclone, an open-source command-line tool for syncing files to cloud storage, is used to exfiltrate collected data to attacker-controlled MEGA or Dropbox accounts. WinSCP is an alternative exfiltration tool observed in Conti campaigns. Exfiltration occurs before encryption, giving operators their double extortion leverage regardless of whether the victim restores from backup.
Impact
Data Encrypted for Impact T1486Service Stop T1489Inhibit System Recovery T1490
Conti uses a unique AES-256 key per file, wrapped with a victim-specific RSA-4096 public key embedded in the binary. Encryption runs across 32 concurrent threads using Windows I/O Completion Ports, making it significantly faster than most ransomware families. Windows Restart Manager (rstrtmgr.dll) is abused to unlock files held open by running processes before encryption. Up to 146 Windows services are stopped via net stop. Volume Shadow Copies are deleted via vssadmin delete shadows or WMI to prevent recovery. Encrypted files receive the .CONTI extension and a CONTI_README.txt ransom note is dropped in each affected folder.
Reconnaissance / Resource Development—Pre-compromise reconnaissance is handled externally. Resource development (infrastructure, tooling, loaders) is managed by dedicated Wizard Spider team members separate from the operators who conduct post-exploitation.
How the attack startsT1566.001 · T1566.002 · T1078 · T1190

Initial access

Conti gained initial access through multiple vectors, and operators switched between them depending on the target. Phishing emails were the most consistently documented method. Malicious Office attachments, most often Excel files containing macros, downloaded TrickBot or staged Cobalt Strike directly. BazarLoader arrived via phishing links pointing to Google Drive or similar file-hosting services. Spear-phishing was tailored, with operators researching targets before sending, and some campaigns used callback phishing, where a phishing email prompted the recipient to call a number, which then instructed them to install remote access software.

Stolen or brute-forced RDP credentials represented a parallel and equally significant entry point. Where external RDP was exposed with weak or reused credentials, operators could enter directly without a phishing step. The CISA and FBI advisory specifically called out stolen RDP credentials as a primary observed vector alongside TrickBot-delivered access.

Conti operators also moved quickly on disclosed vulnerabilities. ProxyShell against Microsoft Exchange (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) gave direct server access. FortiGate firewall vulnerabilities (CVE-2018-13379 and CVE-2018-13374) allowed credential extraction from SSL-VPN sessions. Zerologon (CVE-2020-1472) provided a path to domain controller compromise from an existing network foothold. The leaked playbook documented these exploits as standard operator tools, not opportunistic additions.

The attack on Ireland's Health Service Executive (HSE) in May 2021 began with a single employee opening a malicious Excel attachment. That single execution started a chain that ultimately took the national health IT infrastructure offline across dozens of hospitals.

What runs on the endpointT1055.001 · T1003.001 · T1558.003 · T1021.001 · T1021.002

Post-exploitation: from loader to domain admin

Once TrickBot or BazarLoader established the initial foothold, it was used to deploy a Cobalt Strike beacon. From that beacon, operators began hands-on activity. The documented sequence from The DFIR Report's September 2021 incident analysis shows the pattern clearly: within minutes of loader execution, operators used net and nltest to enumerate the domain and identify domain controllers. Cobalt Strike facilitated the heavy lifting of credential theft and pivoting.

Mimikatz was the primary credential harvesting tool. Operators used it to dump LSASS memory and extract plaintext passwords, NTLM hashes, and Kerberos tickets. The leaked Conti playbook documented Invoke-MassMimikatz, a PowerShell-based variant that reflectively loads Mimikatz entirely in memory, avoiding a binary on disk. The comsvcs DLL MiniDump technique provided an alternative LSASS dump path that bypasses tools that specifically watch for mimikatz.exe. Kerberoasting extracted service account hashes for offline cracking. reg save commands dumped the SAM and SYSTEM registry hives.

With domain credentials obtained, operators moved to domain controllers via RDP. BloodHound was used to map AD attack paths and identify the shortest route to Domain Admin. From the domain controller, the attack expanded outward. Operators identified backup servers, SQL servers, and file shares. AnyDesk or Atera was installed as a persistent out-of-band access channel separate from the Cobalt Strike infrastructure, providing a fallback if the beacon was detected and removed.

Rclone was then used to systematically sync targeted data to attacker-controlled cloud storage. Exfiltration completed before encryption began, ensuring the double extortion leverage existed regardless of the victim's recovery capabilities.

How the malware evades detectionT1027 · T1140 · T1562.001 · T1490 · T1219

Defense evasion

Conti's binary uses API hashing with the Murmur2A algorithm to load Windows API functions dynamically, avoiding a static import table that security tools can interrogate. The payload DLL is delivered encrypted and decrypted at runtime using a hardcoded AES-256 key, so the malicious code is never written to disk in an unpacked state. DLL injection loads the payload into memory of a running process rather than as a standalone executable.

Before triggering encryption, operators conduct a systematic pre-encryption sweep to remove recovery and detection capabilities. Up to 146 Windows services are stopped using net stop, covering backup solutions (Veeam, BackupExec, Acronis), SQL databases, antivirus products, and email servers. Windows Defender real-time monitoring is disabled. Volume Shadow Copies are deleted using either vssadmin delete shadows /all /quiet or through WMI, removing the most common self-service recovery mechanism for endpoints.

Legitimate remote access tools such as AnyDesk function as a persistence mechanism that blends with normal IT activity. Traffic from these tools is encrypted and originates from a signed application, making it harder to distinguish from legitimate remote support traffic on proxy or firewall logs alone. Operators also rename or repath some tools to evade detections keyed to specific filenames.

The use of living-off-the-land tools throughout the post-exploitation phase (net, nltest, wmic, PsExec, Rclone, native Windows task scheduling) means the majority of operator activity generates events that look similar to legitimate administrative work. The signal is in the combination and timing, not any single command.

What it tries to access or modifyT1486 · T1489 · T1490 · T1567.002

Encryption and impact

Conti's encryption engine is purpose-built for speed. It generates a unique AES-256 key per file using CryptGenKey() with the CALG_AES_256 algorithm. Each file key is then encrypted with a victim-specific RSA-4096 public key embedded in the binary and appended to the encrypted file footer. Without the operator's corresponding RSA private key, decryption is computationally infeasible. The encrypted AES key is exported using CryptExportKey() and appended to each file.

What distinguishes Conti's encryption from most ransomware is its use of Windows I/O Completion Ports to run 32 concurrent encryption threads simultaneously. This approach saturates available CPU cores and drives file encryption at a rate that outpaces most real-time detection workflows. By the time CPU utilization spikes are noticed, significant encryption may already have occurred across local and network paths.

Conti targets both local drives and remote SMB network shares in its default --encrypt-mode all configuration. It uses the ARP cache, retrieved via GetIpNetTable(), to enumerate adjacent hosts. Network shares on those hosts are enumerated via NetShareEnum() and encrypted directly. Operators can supply a file containing DNS or NetBIOS hostnames to explicitly target specific servers using the -h argument.

Windows Restart Manager (rstrtmgr.dll) is called to unlock files held open by running applications before encryption attempts them. This allows Conti to reach database files, email stores, and other application-locked data that most ransomware simply skips. Files with .exe, .dll, .sys, .lnk, and .CONTI extensions are excluded to keep the system functional enough to display the ransom note. The note (CONTI_README.txt) is written to each folder before file iteration begins.

Process tree

What the kill chain looks like in EDR telemetry

How Malware Protection Plus responds

A walkthrough showing detection of the Conti pre-encryption chain, automated containment of the affected endpoint, and forensic capture of the LSASS dump and Rclone exfiltration artifacts.

Indicators of compromise

The indicators below are split into durable and volatile categories. Durable indicators reflect behaviors and artifacts that persist across Conti variants and campaign rotations. Volatile indicators such as specific hashes, IPs, and domains expire rapidly and should be sourced from current threat intelligence feeds.

Durable — process and command-line patterns

6 patterns

Parent-child execution chains and command patterns consistent across Conti campaigns.

  • Office process → cmd.exe / powershell.exe downloading remote payloadTrickBot / BazarLoader staging — initial execution
  • nltest.exe /domain_trusts · net view /domainAD discovery — documented in Conti playbook
  • comsvcs.dll MiniDump [pid] lsass.dmp fullLSASS memory dump — alternative Mimikatz path
  • rclone.exe copy [source] [remote]:exfilData exfiltration — CISA-confirmed Conti tool
  • vssadmin delete shadows /all /quietShadow copy deletion — pre-encryption preparation
  • wmic /node:"[HOST]" process call create "C:\[payload].exe"Remote ransomware execution — domain-wide deployment

Durable — file and registry artifacts

5 indicators

File artifacts and registry modifications associated with Conti infections.

  • CONTI_README.txtRansom note — dropped in every encrypted folder
  • *.CONTI (encrypted file extension)Post-encryption file extension
  • Mutex: _C3O4N5T6I7_Conti mutex — prevents double-execution on same host
  • lsass.dmp in user-writable paths (%TEMP%, %ProgramData%)LSASS dump staging artifact
  • AnyDesk or Atera installed outside normal IT provisioningPersistence backdoor — ACSC-documented Conti behavior

Durable — network behavior

4 patterns

Network-layer indicators observable at firewall, proxy, or DNS logs.

  • Rclone outbound HTTPS to MEGA or Dropbox from server systemsExfiltration over cloud storage — CISA-confirmed
  • Cobalt Strike HTTPS beacon traffic (malleable C2 profiles)Operator C2 channel
  • AnyDesk relay traffic from unexpected endpointsPersistence channel — post-initial-access
  • SMB lateral spread from newly compromised hosts (unusual source)Ransomware SMB self-propagation

Volatile — use with caution

Note

Specific file hashes, IP addresses, and domains associated with Conti rotate frequently and expire within days to weeks. The CISA advisory (updated March 2022) provides domains with characteristics similar to Conti infrastructure at the time of publication. For current volatile IOCs, reference MITRE ATT&CK Software entry S0575, CISA's STIX-format IOC package, or current threat intelligence feeds. Do not rely on hash-based detections alone — Conti operators rebuilt payloads per victim to rotate hashes.

Detection guidance

Conti's kill chain is long and hands-on. The majority of the dwell period consists of legitimate administrative tools being used in illegitimate sequences. Hash-based detection misses most of it. Behavioral detection — correlating process relationships, command-line patterns, and access anomalies — is where Conti is catchable, and most catches happen well before encryption begins.

  1. 01

    Office process spawning download or script interpreters

    Endpoint telemetry

    Alert on EXCEL.EXE, WINWORD.EXE, or MSPUB.EXE spawning cmd.exe or powershell.exe with arguments that include DownloadString, IEX, encoded command blocks (-enc), or external URL references.

    Why it works: the Ireland HSE attack and BazarCall-to-Conti incidents documented by The DFIR Report both began with this pattern. Legitimate Office macros rarely download and execute remote scripts.

  2. 02

    LSASS memory access from non-system processes

    EDR / API telemetry

    Alert on any process other than the Windows kernel, anti-malware services, or designated security tools opening a handle to lsass.exe with PROCESS_VM_READ rights. Separately alert on rundll32.exe invoking comsvcs.dll with MiniDump arguments, and on powershell.exe executing Invoke-MassMimikatz or reflective loading patterns.

    Why it works: LSASS access is the single highest-confidence indicator that credential harvesting is underway. Catching it stops the lateral movement phase before operators reach the domain controller.

  3. 03

    Bulk net stop execution against security and backup services

    Process telemetry

    Alert when net.exe stop or sc.exe stop is called in rapid succession against more than five services in a short window, particularly where targeted service names include backup agents (Veeam, BackupExec), antivirus products, or SQL services. Separately alert on Set-MpPreference -DisableRealTimeMonitoring $true in PowerShell.

    Why it works: Conti's pre-encryption preparation stops up to 146 services. This is detectable as a mass-stop event that is not associated with legitimate maintenance windows. Catching it during this phase gives defenders time to isolate before encryption begins.

  4. 04

    Shadow copy deletion commands

    Process telemetry

    vssadmin.exe delete shadows or WMI calls that delete shadow copies from any process other than a trusted backup agent. Alert also on bcdedit /set {default} recoveryenabled No and bcdedit /set {default} bootstatuspolicy ignoreallerrors, which disable recovery boot options.

    Why it works: shadow copy deletion is ransomware-specific behavior. No legitimate administrative workflow deletes all shadow copies with a quiet flag during business hours outside a documented maintenance window. This detection fires minutes before encryption starts.

  5. 05

    Rclone execution on servers or domain controllers

    Process and network telemetry

    Alert on rclone.exe executing on any system where it is not an approved tool, particularly with arguments referencing mega, dropbox, or other cloud storage endpoints. Separately alert on rclone.conf files created in user profiles or temp paths outside standard tool installation directories.

    Why it works: Rclone is an open-source tool with no legitimate use case on most Windows servers. Its presence is a direct indicator that data exfiltration is in progress or has recently completed.

  6. 06

    WMIC remote process creation to push executables

    Process and network telemetry

    wmic.exe /node:[REMOTE_HOST] process call create [executable] from any non-authorized management host. Alert also on PsExec with domain-wide target arguments (\\*) executing paths that match staging locations in user-writable directories.

    Why it works: remote process creation via WMIC is the documented Conti ransomware deployment mechanism. When combined with prior alerts on shadow copy deletion and service stopping, this constitutes a nearly unambiguous ransomware deployment sequence.

  7. 07

    Unexpected RMM tool installation

    Endpoint telemetry

    Alert on AnyDesk, Atera, or similar remote management tools installed outside an approved IT deployment process, particularly on servers or domain controllers. Cross-reference installation events against authorized device management records.

    Why it works: Conti operators install RMM tools as a fallback persistence mechanism. Finding AnyDesk on a server that IT did not provision is a strong indicator the host is compromised, and the detection fires well before any encryption event.

  8. 08

    Mass file extension change to .CONTI

    File system telemetry

    File system monitoring for mass rename operations changing file extensions across multiple directories in a short time window, especially from a process that is not a known backup or archiving application. The appearance of CONTI_README.txt in any directory is a definitive encryption indicator.

    Why it works: by this point the encryption has already started, but early detection limits scope. The ransom note drop precedes file iteration in Conti's execution sequence, so detecting the note write can provide a narrow window for isolation.

Hardening recommendations

The controls below address specific Conti attack behaviors documented in CISA advisory AA21-265A, ACSC's Conti Ransomware Profile, and The DFIR Report incident analyses. Items are tagged by deployment difficulty: Quick win = single policy or rule, deployable in days. Standard = requires phased rollout or workflow changes.

  1. Require MFA for all remote access, especially RDP and VPN

    Quick win

    Stolen or brute-forced RDP credentials are a primary Conti entry vector. MFA eliminates this path for attackers who have obtained valid credentials but do not control the second factor. This single control blocks one of the two most common Conti access methods.

    Path: enforce via conditional access policies, network-level authentication on RDP, and VPN gateway MFA requirements. Disable legacy authentication protocols that do not support MFA.

  2. Patch internet-facing systems promptly, prioritizing Exchange, VPN appliances, and AD

    Quick win

    Conti operators exploited ProxyShell within days of public disclosure. Zerologon, PrintNightmare, and FortiGate vulnerabilities were all part of the documented Conti playbook. A delayed patching cycle for internet-facing or domain-tier systems directly enables this attack chain.

    Path: establish a risk-tiered patching policy that prioritizes internet-facing infrastructure and domain controllers on an accelerated cycle relative to internal workstations.

  3. Protect LSASS using Windows Credential Guard and attack surface reduction rules

    Standard

    Windows Credential Guard moves credential material into a virtualization-based security boundary that Mimikatz cannot reach through normal LSASS access. Microsoft's Attack Surface Reduction rule "Block credential stealing from the Windows local security authority subsystem" (LSASS protection ASR rule) adds a further layer of defense against LSASS dumping techniques including comsvcs MiniDump.

    Path: enable Credential Guard via Group Policy (Device Guard) and test ASR rules in audit mode before enforcement. Both require Windows 10 or later with Virtualization Based Security support.

  4. Restrict or monitor RMM tool deployment

    Quick win

    AnyDesk and Atera are legitimate tools that Conti uses as persistence backdoors. Application allowlisting or deployment policy enforcement that blocks unauthorized RMM software installation on servers and domain controllers prevents this persistence channel. Where RMM tools are legitimately used, monitor for unexpected new installations or connection sources.

    Path: implement via AppLocker, WDAC, or endpoint management policy. Maintain an authorized RMM software registry and alert on deviations.

  5. Implement network segmentation to limit SMB lateral movement

    Standard

    Conti's encryption payload traverses open SMB shares across the local network. Segmentation that restricts SMB access between user workstations and between workstations and servers limits how far the payload propagates before it can be contained. Domain controllers should not have unrestricted SMB access from workstation segments.

    Path: define network zones with explicit firewall rules. Disable SMB 1.0. Enforce least-privilege file share ACLs. Monitor East-West SMB traffic for unusual volumes or source hosts.

  6. Test and protect offline backups

    Quick win

    Conti stops backup services and deletes shadow copies as part of its pre-encryption sequence. Backups connected to the domain or accessible via domain credentials are reachable and can be encrypted or destroyed. Immutable or air-gapped backup copies are the only recovery option that survives a full Conti deployment.

    Path: maintain at least one offline or immutable backup copy per the 3-2-1 rule. Test restoration quarterly. Ensure backup agent service accounts use unique credentials not shared with domain admin accounts.

Response recommendations

Conti is a dwell-heavy attack. The encryption event is the last step in a chain that may have been running for days or weeks. Response must address the full intrusion, not just the ransomware binary.

  1. Isolate affected endpoints immediately, but do not power off before forensic triage

    Immediate

    Network isolate systems showing encryption behavior or pre-encryption indicators (mass service stopping, VSS deletion). Avoid powering off systems before capturing volatile forensic data including running processes, network connections, and memory — these contain evidence of the loader and Cobalt Strike beacon that are not present on disk.

  2. Revoke all domain credentials and rotate service account passwords

    Immediate

    Conti operators dump credentials across the domain. Any account whose hash or cleartext password was exposed during the intrusion must be treated as compromised. Reset all domain user passwords, all service accounts, and all local administrator passwords using a tool like LAPS before re-enabling network connectivity. Do not reuse the same password rotation method that may have been compromised.

  3. Identify and remove all persistence mechanisms before recovery

    Before restoration

    AnyDesk, Atera, Cobalt Strike beacons, scheduled tasks, and registry Run keys installed by the operator must all be removed before systems are reconnected. Rebuilding from backup without removing persistence means operators can re-enter immediately. Hunt for installed RMM software, unexpected scheduled tasks, and new local administrator accounts across all domain-joined systems.

  4. Assume data was exfiltrated and assess disclosure obligations

    Parallel track

    Conti's double extortion model means exfiltration occurred before encryption. Review Rclone usage, proxy logs, and firewall records for outbound transfers to MEGA, Dropbox, or unusual cloud endpoints in the weeks before the encryption event. Engage legal counsel on breach notification obligations based on what data categories were reachable during the intrusion window.

  5. Validate backup integrity before restoration

    Before restoration

    Conti operators had dwell times of days to weeks. Backups taken during the dwell period may contain the loader, Cobalt Strike artifacts, or modified files. Identify the earliest clean snapshot predating the initial access event (often identifiable from TrickBot or BazarLoader execution logs). Test restoration of critical systems to isolated environments before reconnecting to production.

Primary references

Source material this page is built on. Reviewed against CISA, FBI, NSA, ACSC, and The DFIR Report documentation through June 2026.

Detect the Conti attack chain before encryption begins.

Malware Protection Plus detects the behavioral signs of ransomware, including LSASS access, shadow copy deletion, Rclone activity, and mass service termination.

Start free trial →