conti Ransomware
Tracked since Jul 31, 2020
0
victims recorded
0
in the last 30 days
3
CVEs
—
Last activity
In MITRE ATT&CK MITRE ATT&CK
Ransomware cataloged as Conti (S0575)
Used by: Wizard Spider G0102
Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2021-44228 Critical · 10.0 KEV Apache Log4j2 Remote Code Execution Vulnerability
- CVE-2021-34527 High · 8.8 KEV Microsoft Windows Print Spooler Remote Code Execution Vulnerability
- CVE-2020-1472 Medium · 5.5 KEV Microsoft Netlogon Privilege Escalation Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078.002 Valid Accounts: Domain AccountsT1190 Exploit Public-Facing ApplicationT1566.001 Phishing: Spearphishing Attachment Execution
T1047 Windows Management InstrumentationT1059.001 Command and Scripting Interpreter: PowerShell Persistence
T1136.002 Create Account: Domain AccountT1547.001 Boot or Logon Autostart Execution: Registry Run Keys Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1218.011 Signed Binary Proxy Execution: Rundll32T1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1003.003 OS Credential Dumping: NTDS Discovery
T1046 Network Service DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Collection
T1005 Data from Local SystemT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Observed tools
Credential Theft
Mimikatz · ProcDump · Router Scan · SharpChrome
Defense Evasion
GMER · PCHunter
Discovery Enum
AdFind · Bloodhound · PowerView · Seatbelt · ShareFinder · SharpView · SoftPerfect NetScan
Exfiltration
Dropfiles · MEGA · Qaz[.]im · RClone · Sendspace · WinSCP
LOLBAS
BITSAdmin · NTDS Utility (ntdsutil) · PsExec · WMIC
Offsec
Cobalt Strike · Metasploit · Meterpreter · PowerShell Empire · PowerSploit · Rubeus
RMM-Tools
AnyDesk · Atera · Splashtop
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live