Conti
MITRE ATT&CK: S0575 View on attack.mitre.org
Aliases: Conti
- First seen
- 2019-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 124 (120 malicious)
- Last IoC activity
- 2026-10-18 01:56:50
- Profile updated
- 2026-07-07 12:37:42
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical financial-services technology-and-telecommunications
Targeted regions: country_code:us country_code:ca
Context
Conti is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019. Conti has been deployed via TrickBot and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors using Conti steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.
Recent IoC activity
120 malicious indicators in Maltiverse are attributed to Conti (S0575). The 20 most recently updated:
Detection coverage
- 6 YARA rules
- 297 Sigma rules
Malware & tools used
- Network Share Discovery (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Service Stop (attack-pattern)
- File and Directory Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
- Remote System Discovery (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- Taint Shared Content (attack-pattern)
- Windows Command Shell (attack-pattern)
- Process Discovery (attack-pattern)
- Native API (attack-pattern)
- SMB/Windows Admin Shares (attack-pattern)
Used by threat actors
- Wizard Spider (threat-actor)
- C0015 (campaign)
Detection rules
- TRELLIX_ARC_Ransom_Conti (yara-rule)
- CAPE_Conti (yara-rule)
- MALPEDIA_Win_Conti_Auto (yara-rule)
- SIGNATURE_BASE_MAL_RANSOM_Conticrypter (yara-rule)
- ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 (yara-rule)
- ARKBIRD_SOLG_RAN_Conti_May_2021_2 (yara-rule)
Related threat objects
- BlackByte (malware)
- QuantumLocker (malware)
- BlackBasta (malware)
Reports & references
- pwc.com — Yir Cyber Threats Annex Download (report)
- blog.google — Exposing Initial Access Broker Ties Conti (report)
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- CrowdStrike — Wizard Spider Adversary Update (report)
- cyber.gov.au — 2021 010 Acsc Ransomware Profile Conti (report)
- s3.amazonaws.com — Ransomware Chats (report)
- Broadcom/Symantec — Ransomware Virtual Machines (report)
- threatpost.com — 168442 (report)
- Palo Alto Unit 42 — Conti Ransomware Gang (report)
- intel471.com — Malware Before Ransomware Trojan Information Stealer Cobalt Strike (report)
- advintel.io — Advintel S State Of Emotet Aka Spmtools Displays Over Million Compromised Machines Through 2022 (report)
- esentire.com — Analysis Of Leaked Conti Intrusion Procedures By Esentires Threat Response Unit Tru (report)
- secureworks.com — Gold Ulrick Continues Conti Operations Despite Public Disclosures (report)
- threatstop.com — First Conti Then Hive Costa Rica Gets Hit With Ransomware Again (report)
- Trend Micro — Lockbit Conti And Blackcat Lead Pack Amid Rise In Active Raas And Extortion Groups Ransomware In Q1 2022 (report)
- trellix.com — Conti Group Targets Esxi Hypervisors With Its Linux Variant (report)
- youtube.com — Watch (report)
- chuongdong.com — Contiransomware (report)
- 0xthreatintel.medium.com — Reversing Conti Ransomware Bfce15019E74 (report)
- arcticwolf.com — Conti Ransomware Leak Analyzed (report)
- arcticwolf.com — Karakurt Web (report)
- areteir.com — Arete Insight Is Conti The New Ryuk August2020 (report)
- assets.sentinelone.com — Conti Ransomware Unpacked (report)
- attackiq.com — Attack Graph Emulating The Conti Ransomware Teams Behaviors (report)
- blog.bushidotoken.net — Lessons From Conti Leaks (report)