Conti

How Conti typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Conti.

1. T1059.003 Windows Command Shell Execution

   What they do: Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

   What that means: Adversaries may abuse the Windows command shell for execution.

2. T1106 Native API Execution

   What they do: Conti has used API calls during execution.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

3. T1055.001 Dynamic-link Library Injection Privilege EscalationStealth

   What they do: Conti has loaded an encrypted DLL into memory and then executes it.

   What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

4. T1027 Obfuscated Files or Information Stealth

   What they do: Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

   What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

5. T1140 Deobfuscate/Decode Files or Information Stealth

   What they do: Conti has decrypted its payload using a hardcoded AES-256 key.

   What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

6. T1016 System Network Configuration Discovery Discovery

   What they do: Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

   What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

7. T1018 Remote System Discovery Discovery

   What they do: Conti has the ability to discover hosts on a target network.

   What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

8. T1049 System Network Connections Discovery Discovery

   What they do: Conti can enumerate routine network connections from a compromised host.

   What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

9. T1057 Process Discovery Discovery

   What they do: Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.

   What that means: Adversaries may attempt to get information about running processes on a system.

10. T1083 File and Directory Discovery Discovery

    What they do: Conti can discover files on a local system.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

11. T1135 Network Share Discovery Discovery

    What they do: Conti can enumerate remote open SMB network shares using NetShareEnum().

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

12. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

13. T1080 Taint Shared Content Lateral Movement

    What they do: Conti can spread itself by infecting other remote machines via network shared drives.

    What that means: Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories.

14. T1486 Data Encrypted for Impact Impact

    What they do: Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

15. T1489 Service Stop Impact

    What they do: Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

16. T1490 Inhibit System Recovery Impact

    What they do: Conti can delete Windows Volume Shadow Copies using vssadmin.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Conti has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

+91 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

All of your files are currently encrypted by CONTI strain. If you don't know who we are - just "Google it."

As you already know, all of your data has been encrypted by our software.
It cannot be recovered by any means without contacting our team directly.

DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However,
if you want to try - we recommend choosing the data of the lowest value.

DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond.
So it will be better for both sides if you contact us as soon as possible.

DON'T TRY TO CONTACT feds or any recovery companies.
We have our informants in these structures, so any of your complaints will be immediately directed to us.
So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately.

To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge.

You can contact our team directly for further instructions through our website :

TOR VERSION :
(you should download and install TOR browser first https://torproject[.]org)

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/[snip]

YOU SHOULD BE AWARE!
We will speak only with an authorized person. It can be the CEO, top management, etc.
In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!
Inform your supervisors and stay calm!

All of your files are currently encrypted by CONTI strain. 

As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. 
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.

To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.

You can contact our team directly for further instructions through our website :

TOR VERSION :
(you should download and install TOR browser first https://torproject.org)

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

HTTPS VERSION :
https://contirecovery.xyz/

YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.


---BEGIN ID---
[snip]
---END ID---

All of your files are currently encrypted by CONTI strain. 

As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. 
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.

To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.

You can contact our team directly for further instructions through our website :

TOR VERSION :
(you should download and install TOR browser first https://torproject.org)

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/[snip]

YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.


---BEGIN ID---
[snip]
---END ID---

All of your files are currently encrypted by CONTI ransomware. 
If you try to use any additional recovery software - the files might be damaged or lost.

To make sure that we REALLY CAN recover data - we offer you to decrypt samples. 

You can contact us for further instructions through our website : 

TOR VERSION : 
(you should download and install TOR browser first https://torproject.org) 

http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion 

HTTPS VERSION : 
https://contirecovery.info 

YOU SHOULD BE AWARE! 
Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP.

---BEGIN ID---
[snip]
---END ID---

Ransom-note text from RansomLook, licensed CC BY 4.0.