conti Ransomware
Monitorado desde 31/07/2020
0
vítimas registradas
0
nos últimos 30 dias
3
CVEs
—
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Ransomware catalogado como Conti (S0575)
Usado por: Wizard Spider G0102
Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2021-44228 Crítica · 10.0 KEV Apache Log4j2 Remote Code Execution Vulnerability
- CVE-2021-34527 Alta · 8.8 KEV Microsoft Windows Print Spooler Remote Code Execution Vulnerability
- CVE-2020-1472 Média · 5.5 KEV Microsoft Netlogon Privilege Escalation Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078.002 Valid Accounts: Domain AccountsT1190 Exploit Public-Facing ApplicationT1566.001 Phishing: Spearphishing Attachment Execution
T1047 Windows Management InstrumentationT1059.001 Command and Scripting Interpreter: PowerShell Persistence
T1136.002 Create Account: Domain AccountT1547.001 Boot or Logon Autostart Execution: Registry Run Keys Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1218.011 Signed Binary Proxy Execution: Rundll32T1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1003.003 OS Credential Dumping: NTDS Discovery
T1046 Network Service DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Collection
T1005 Data from Local SystemT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Ferramentas observadas
Credential Theft
Mimikatz · ProcDump · Router Scan · SharpChrome
Defense Evasion
GMER · PCHunter
Discovery Enum
AdFind · Bloodhound · PowerView · Seatbelt · ShareFinder · SharpView · SoftPerfect NetScan
Exfiltration
Dropfiles · MEGA · Qaz[.]im · RClone · Sendspace · WinSCP
LOLBAS
BITSAdmin · NTDS Utility (ntdsutil) · PsExec · WMIC
Offsec
Cobalt Strike · Metasploit · Meterpreter · PowerShell Empire · PowerSploit · Rubeus
RMM-Tools
AnyDesk · Atera · Splashtop
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live