# Conti Ransomware

Ransomware (RaaS) · First seen December 2019 · Disbanded May 2022 · Legacy active via successor groups · Last updated June 29, 2026

## Overview

Conti is a human operated ransomware family operated as ransomware-as-a-service by the Russia-based threat group tracked as Wizard Spider. First observed in December 2019, it evolved directly from the Ryuk ransomware codebase and rapidly became one of the most destructive and financially prolific ransomware operations on record. Between 2020 and May 2022, the group recorded an estimated $180 million in annual revenue at peak, with the FBI estimating cumulative payments exceeding $150 million across more than 1,000 confirmed victims.

Conti differs from most RaaS operations in how it compensated its workforce. Rather than splitting ransom proceeds with affiliates on a percentage basis, Conti paid operators fixed monthly wages, structuring itself more like a corporation than a criminal collective. Leaked internal communications from February 2022 revealed an organization of approximately 62 to over 100 personnel with dedicated roles spanning development, penetration testing, negotiation, and human resources.

The group's attack model combined established malware delivery infrastructure with hands-on post-exploitation. Initial access arrived through TrickBot and BazarLoader infections, which were used to stage Cobalt Strike beacons. From there, operators conducted Active Directory reconnaissance, harvested credentials using Mimikatz and related tooling, moved laterally via RDP and SMB, exfiltrated data using Rclone, then deployed Conti's multi-threaded encryption payload across the domain. The full chain from initial access to domain-wide encryption was documented in incidents lasting as few as 32 hours.

In February 2022, following Russia's invasion of Ukraine, Conti publicly announced its support for the Russian government. A Ukrainian affiliate responded by leaking over 60,000 internal chat messages, technical manuals, and source code. The reputational and operational damage was severe. Victims stopped paying, and the brand became a liability. By May 2022, Conti's infrastructure, including its leak site and negotiation portals, had been shut down. The group did not disappear. Its operators redistributed into successor groups including Black Basta, Karakurt, BlackByte, Royal, and Akira, carrying the same tooling, playbooks, and personnel. Those groups remain active.

CISA and the FBI jointly issued an advisory on Conti in September 2021, updated through March 2022, documenting over 400 attacks against US and international organizations. In September 2023, the US Department of Justice indicted four Russian nationals for their roles in the operation. A loader developer, Oleksii Lytvynenko, pleaded guilty in 2026 under FBI Operation Riptide.

### Threat profile

**Updated:** June 29, 2026

- **Type:** Ransomware (RaaS)
- **First seen:** Dec 2019
- **Operator:** Wizard Spider
- **Status:** Disbanded · Legacy active
- **Aliases:** Wizard Spider · DEV-0193 (Microsoft)
- **Disbanded:** May 2022
- **Delivery vectors:** TrickBot · BazarLoader · phishing · RDP abuse · ProxyShell · FortiGate CVEs
- **Primary targets:** Windows endpoints · AD environments · healthcare · critical infrastructure · government
- **Post-exploitation:** Cobalt Strike · Mimikatz · AnyDesk · Rclone
- **Successor groups:** Black Basta · Karakurt · Royal · Akira · BlackByte
- **Encryption:** AES-256 per file · RSA-4096 key wrap · 32 concurrent threads
- **Extortion model:** Double extortion · data leak site · access resale

## Operational attack chain · TrickBot/BazarLoader-to-Conti

1. **Initial access**  
   Phishing email · malicious attachment · stolen RDP credentials · exploit (ProxyShell / Zerologon / FortiGate)

2. **Loader execution**  
   TrickBot or BazarLoader establishes first-stage foothold and C2 channel

3. **Cobalt Strike beacon deployed**  
   Loader fetches Cobalt Strike · operator takes hands-on control

4. **Reconnaissance and credential harvesting**  
   `nltest · net · whoami · BloodHound · Mimikatz · Kerberoasting`  
   AD discovery · LSASS dump · Pass-the-hash

5. **Lateral movement to domain controller**  
   RDP with harvested credentials · PsExec · SMB · AnyDesk persistence

6. **Data exfiltration**  
   Rclone syncs sensitive files to attacker-controlled cloud storage (MEGA · Dropbox)

7. **Pre-encryption preparation**  
   `net stop` terminates 146 services · VSS deleted · Windows Defender disabled

8. **Domain-wide encryption + double extortion**  
   PsExec or WMIC deploys Conti across all joined hosts · `CONTI_README.txt` dropped · leak site activated

The dwell time between initial BazarLoader execution and ransomware deployment ranged from 32 hours to several weeks in documented incidents. Operators used the dwell period to maximize AD access, complete exfiltration, and identify high value servers before triggering encryption.

## Tactics, techniques, and procedures

Conti's technique density is highest in Lateral Movement, Credential Access, and Impact. Its post-exploitation phase is hands-on and systematic: operators enumerate, elevate, and pivot before any encryption occurs. The kill chain covers at least 11 of 14 MITRE ATT&CK enterprise tactics.

### MITRE ATT&CK coverage

- Recon: 0 (Not observed)
- Resource Development: 1 (Active)
- Initial Access: 3 (Heavy)
- Execution: 2 (Active)
- Persistence: 2 (Active)
- Privilege Escalation: 3 (Heavy)
- Defense Evasion: 3 (Active)
- Credential Access: 3 (Heavy)
- Discovery: 4 (Heavy)
- Lateral Movement: 3 (Heavy)
- Collection: 1 (Active)
- Command and Control: 2 (Active)
- Exfiltration: 1 (Active)
- Impact: 3 (Heavy)

### Technique detail

| Tactic | Techniques | What Conti does |
|---|---|---|
| Initial Access | [Spearphishing Attachment T1566.001](https://attack.mitre.org/techniques/T1566/001/) · [Spearphishing Link T1566.002](https://attack.mitre.org/techniques/T1566/002/) · [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) · [Exploit Public-Facing App T1190](https://attack.mitre.org/techniques/T1190/) | Phishing emails deliver malicious Office attachments or links that stage TrickBot or BazarLoader. Stolen or brute-forced RDP credentials are also a documented primary vector. Operators have exploited ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), Zerologon (CVE-2020-1472), and FortiGate vulnerabilities (CVE-2018-13379) for direct network access. |
| Execution | [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/) · [Native API T1106](https://attack.mitre.org/techniques/T1106/) | Conti accepts command-line arguments that control encryption scope (`--encrypt-mode all/local/network`) and target host lists (`-h`). Ransomware deployment across the domain uses WMIC remote process creation or PsExec with batch files. The encryption engine calls Windows I/O Completion Port APIs (`CreateIoCompletionPort`, `PostQueuedCompletionStatus`, `GetQueuedCompletionStatus`) to drive 32 concurrent encryption threads. |
| Persistence | [External Remote Services T1133](https://attack.mitre.org/techniques/T1133/) · [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) | Operators install AnyDesk or Atera remote management software on compromised hosts to maintain a persistent, out-of-band access channel that survives antivirus remediation of the original loader. Stolen domain credentials allow re-entry via RDP or VPN independently of any malware artifact. |
| Privilege Escalation | [DLL Injection T1055.001](https://attack.mitre.org/techniques/T1055/001/) · [Exploitation for Priv Esc T1068](https://attack.mitre.org/techniques/T1068/) · [Access Token Manipulation T1134](https://attack.mitre.org/techniques/T1134/) | Conti loads an encrypted DLL into memory and executes it to achieve initial privilege elevation. Operators exploit PrintNightmare (CVE-2021-34527), Zerologon (CVE-2020-1472), and EternalBlue (CVE-2017-0144) for domain privilege escalation. RouterScan is used to brute-force router and NAS credentials for additional footholds. |
| Defense Evasion | [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/) · [Deobfuscate / Decode T1140](https://attack.mitre.org/techniques/T1140/) · [Disable Security Tools T1562.001](https://attack.mitre.org/techniques/T1562/001/) | The Conti payload is delivered as an encrypted DLL decoded at runtime using a hardcoded AES-256 key. The binary hashes Windows API names with the Murmur2A algorithm and loads them dynamically. Before encryption, operators disable Windows Defender and stop 146 Windows services using `net stop`. Shadow copies are deleted via `vssadmin` or WMI. |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) · [Kerberoasting T1558.003](https://attack.mitre.org/techniques/T1558/003/) · [Brute Force T1110](https://attack.mitre.org/techniques/T1110/) | Mimikatz extracts plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory. Invoke-MassMimikatz and the comsvcs DLL MiniDump function are alternative LSASS dump methods. Kerberoasting extracts service account hashes for offline cracking. `reg save` exports the SAM and SYSTEM hives for offline extraction. |
| Discovery | [System Information T1082](https://attack.mitre.org/techniques/T1082/) · [Network Config Discovery T1016](https://attack.mitre.org/techniques/T1016/) · [Network Share Discovery T1135](https://attack.mitre.org/techniques/T1135/) · [Process Discovery T1057](https://attack.mitre.org/techniques/T1057/) | Operators use `nltest /domain_trusts`, `net view`, and BloodHound to map AD topology and identify high-value targets. The payload calls `GetIpNetTable()` to retrieve the ARP cache and enumerates SMB shares via `NetShareEnum()`. Process enumeration prioritizes SQL-related services. |
| Lateral Movement | [SMB/Windows Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/) · [Remote Desktop Protocol T1021.001](https://attack.mitre.org/techniques/T1021/001/) · [Taint Shared Content T1080](https://attack.mitre.org/techniques/T1080/) | Operators pivot via RDP using harvested credentials. Cobalt Strike beacons facilitate movement. The ransomware spreads over SMB to accessible shares. WMIC remote process creation (`wmic /node:"HOST" process call create`) is used for controlled deployment. |
| Collection | [Local System Data T1005](https://attack.mitre.org/techniques/T1005/) | Operators stage sensitive files for exfiltration before triggering encryption, targeting financial records, PII, internal documents, and operational data. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/) · [Remote Access Software T1219](https://attack.mitre.org/techniques/T1219/) | Cobalt Strike beacons communicate over HTTPS to operator-controlled C2 servers. AnyDesk and Atera provide secondary remote access channels. |
| Exfiltration | [Exfiltration to Cloud T1567.002](https://attack.mitre.org/techniques/T1567/002/) | Rclone syncs data to attacker-controlled MEGA or Dropbox accounts. WinSCP is an alternative tool observed in campaigns. |
| Impact | [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) · [Service Stop T1489](https://attack.mitre.org/techniques/T1489/) · [Inhibit System Recovery T1490](https://attack.mitre.org/techniques/T1490/) | Conti uses a unique AES-256 key per file, wrapped with a victim-specific RSA-4096 key. Encryption runs across 32 concurrent threads using Windows I/O Completion Ports. Windows Restart Manager (`rstrtmgr.dll`) unlocks files. Up to 146 services are stopped. Shadow copies are deleted. Encrypted files receive the `.CONTI` extension and a `CONTI_README.txt` ransom note is dropped. |

## Indicators of compromise

The indicators below are split into durable and volatile categories. Durable indicators reflect behaviors and artifacts that persist across Conti variants and campaign rotations. Volatile indicators such as specific hashes, IPs, and domains expire rapidly and should be sourced from current threat intelligence feeds.

### Durable — process and command-line patterns

- `Office process → cmd.exe / powershell.exe downloading remote payload`  
  TrickBot / BazarLoader staging — initial execution
- `nltest.exe /domain_trusts · net view /domain`  
  AD discovery — documented in Conti playbook
- `comsvcs.dll MiniDump [pid] lsass.dmp full`  
  LSASS memory dump — alternative Mimikatz path
- `rclone.exe copy [source] [remote]:exfil`  
  Data exfiltration — CISA-confirmed tool
- `vssadmin delete shadows /all /quiet`  
  Shadow copy deletion — pre-encryption preparation
- `wmic /node:"[HOST]" process call create "C:\[payload].exe"`  
  Remote ransomware execution — domain-wide deployment

### Durable — file and registry artifacts

- `CONTI_README.txt` — ransom note dropped in every encrypted folder
- `*.CONTI` — post-encryption file extension
- `Mutex: _C3O4N5T6I7_` — prevents double-execution
- `lsass.dmp` in `%TEMP%` or `%ProgramData%` — LSASS dump staging
- AnyDesk or Atera installed outside normal IT provisioning — persistence backdoor

### Durable — network behavior

- Rclone outbound HTTPS to MEGA or Dropbox from server systems — exfiltration
- Cobalt Strike HTTPS beacon traffic (malleable C2 profiles) — operator C2
- AnyDesk relay traffic from unexpected endpoints — persistence
- SMB lateral spread from newly compromised hosts — ransomware propagation

### Volatile — use with caution

Specific file hashes, IP addresses, and domains associated with Conti rotate frequently and expire within days to weeks. The CISA advisory (updated March 2022) provides domains with characteristics similar to Conti infrastructure at the time of publication. For current volatile IOCs, reference:

- [MITRE ATT&CK — Conti Software S0575](https://attack.mitre.org/software/S0575/)
- [CISA, FBI, NSA — Alert AA21-265A: Conti Ransomware](https://www.cisa.gov/news-events/alerts/2021/09/22/conti-ransomware)

Do not rely on hash-based detections alone — Conti operators rebuilt payloads per victim to rotate hashes.

## Detection guidance

Conti's kill chain is long and hands-on. The majority of the dwell period consists of legitimate administrative tools being used in illegitimate sequences. Hash-based detection misses most of it. Behavioral detection — correlating process relationships, command-line patterns, and access anomalies — is where Conti is catchable.

1. **Office process spawning download or script interpreters**  
   Alert on `EXCEL.EXE`, `WINWORD.EXE`, or `MSPUB.EXE` spawning `cmd.exe` or `powershell.exe` with `DownloadString`, `IEX`, `-enc`, or external URLs.  
   *Why it works:* Early-stage phishing-to-loader behavior is rarely legitimate.

2. **LSASS memory access from non-system processes**  
   Alert on non-security processes opening `lsass.exe` with `PROCESS_VM_READ`. Monitor `rundll32.exe comsvcs.dll MiniDump` and Invoke-MassMimikatz patterns.  
   *Why it works:* High-confidence indicator of credential harvesting.

3. **Bulk net stop execution**  
   Alert when `net.exe stop` or `sc.exe stop` targets multiple services rapidly, especially backup, antivirus, or SQL services. Monitor `Set-MpPreference -DisableRealTimeMonitoring $true`.  
   *Why it works:* Pre-encryption preparation phase.

4. **Shadow copy deletion commands**  
   Alert on `vssadmin delete shadows` or WMI shadow copy deletion outside maintenance windows.  
   *Why it works:* Ransomware-specific recovery inhibition.

5. **Rclone execution on servers**  
   Alert on `rclone.exe` with cloud storage arguments (`mega`, `dropbox`).  
   *Why it works:* Direct indicator of exfiltration.

6. **WMIC remote process creation**  
   Alert on `wmic.exe /node:[REMOTE_HOST] process call create [executable]` from unauthorized hosts.  
   *Why it works:* Documented Conti deployment mechanism.

7. **Unexpected RMM tool installation**  
   Alert on AnyDesk or Atera installed outside approved processes.  
   *Why it works:* Persistence mechanism.

8. **Mass file extension change to .CONTI**  
   Monitor mass rename operations and appearance of `CONTI_README.txt`.  
   *Why it works:* Early encryption-stage detection.

Detections 01–05 fire during dwell, before encryption begins. Prioritize early-stage detection to prevent domain-wide impact.

## Hardening recommendations

Items are tagged by deployment difficulty: **Quick win** = deployable in days. **Standard** = phased rollout required.

1. **Require MFA for all remote access, especially RDP and VPN** — **Quick win**  
   Blocks stolen credential access paths.

2. **Patch internet-facing systems promptly** — **Quick win**  
   Prioritize Exchange, VPN appliances, AD-related vulnerabilities (ProxyShell, Zerologon, PrintNightmare, FortiGate CVEs).

3. **Protect LSASS using Credential Guard and ASR rules** — **Standard**  
   Prevents credential dumping techniques.

4. **Restrict or monitor RMM tool deployment** — **Quick win**  
   Block unauthorized AnyDesk/Atera installations.

5. **Implement network segmentation to limit SMB lateral movement** — **Standard**  
   Restrict workstation-to-server SMB access.

6. **Test and protect offline backups** — **Quick win**  
   Maintain immutable or air-gapped backups per 3-2-1 rule.

## Response recommendations

1. **Isolate affected endpoints immediately** — *Immediate*  
   Capture volatile forensic data before powering off.

2. **Revoke all domain credentials and rotate service accounts** — *Immediate*  
   Treat all harvested credentials as compromised.

3. **Remove all persistence mechanisms before recovery** — *Before restoration*  
   Hunt for RMM tools, scheduled tasks, Cobalt Strike beacons.

4. **Assume data was exfiltrated** — *Parallel track*  
   Review Rclone and outbound cloud traffic logs.

5. **Validate backup integrity before restoration** — *Before restoration*  
   Restore only from snapshots predating initial access.

## Primary references

- [CISA, FBI, NSA — Alert AA21-265A: Conti Ransomware](https://www.cisa.gov/news-events/alerts/2021/09/22/conti-ransomware) — Sep 2021, updated Mar 2022  
- [Australian Cyber Security Centre — Ransomware Profile: Conti](https://www.cyber.gov.au/sites/default/files/2023-02/2021-010%20-%20ACSC%20Ransomware%20Profile%20-%20Conti.pdf) — 2021  
- [The DFIR Report — BazarLoader to Conti Ransomware in 32 Hours](https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/) — Sep 2021  
- [The DFIR Report — BazarCall to Conti Ransomware via TrickBot and Cobalt Strike](https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/) — Aug 2021  
- [MITRE ATT&CK — Conti Software S0575](https://attack.mitre.org/software/S0575/) — Current  
- [Sheridan et al. — Money Over Morals: A Business Analysis of Conti Ransomware](https://arxiv.org/pdf/2304.11681) — 2023  
- [NSA / CISA — Conti Ransomware Advisory PDF (updated)](https://media.defense.gov/2021/Sep/22/2002859507/-1/-1/0/CSA_Conti_Ransomware_20220309.PDF) — Mar 2022