Conti (Windows)
- First seen
- 2020-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:38:06
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical financial-services education-and-nonprofits energy-and-utilities technology-and-telecommunications
Targeted regions: country_code:us
Context
Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
Reports & references
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- pwc.com — Yir Cyber Threats Annex Download (report)
- strapi.eurepoc.eu — Eu Repo C Apt Profile Conti Wizard Spider Dc2A733E18 (report)
- prodaft.com — Wizardspider Tlpwhite V.1.4 (report)
- analyst1.com — Ransom Mafia Analysis Of The World%E2%80%99S First Ransomware Cartel (report)
- CrowdStrike — Report2021Gtr (report)
- analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
- blog.google — Exposing Initial Access Broker Ties Conti (report)
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- decoded.avast.io — Avast Q2 2022 Threat Report (report)
- services.google.com — Threat Horizons Report H1 2025 (report)
- Palo Alto Unit 42 — Luna Moth Callback Phishing (report)
- CrowdStrike — Wizard Spider Adversary Update (report)
- arcticwolf.com — Conti And Akira Chained Together (report)
- Microsoft — Re54L7V (report)
- CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
- domaintools.com — The Most Prolific Ransomware Families A Defenders Guide (report)
- cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- cti-league.com — Cti League Darknet Report 2021 (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- ke-la.com — To Attack Or Not To Attack Targeting The Healthcare Sector In The Underground Ecosystem (report)
- ke-la.com — Zooming Into Darknet Threats Targeting Jp Orgs Kela (report)
- krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)