Conti is a is a ransomware that has been observed since 2020, believed to be distributed by a Russia-based group. It operates as a ransomware-as-a-service (RaaS), enabling other cybercriminals to deploy this malware for their own purposes. Conti is particularly known for its utilization of double extortion techniques, where it not only encrypts victim's files but also steals and threatens to publish sensitive data if the ransom is not paid.
All versions of Microsoft Windows are known to be affected. The United States government offered a reward of up to $10 million for information on the group in early May of 2022.
Description
RaaS model
Conti's ransomware as a service (RaaS) model vary in its structure from a typical affiliate model. Conti developers probably pay the deployers of the ransomware a wage rather than a percentage of the proceeds used by affiliate cyber actors and receives a share of the proceeds from a successful attack.
Tactics and Techniques
Conti ransomware employs various stealthy techniques, including the use of BazarLoader, to infiltrate its target systems. The ransomware is designed to encrypt files and render them inaccessible until a ransom is paid. It is often delivered through phishing emails, exploit kits, or compromised websites. Conti has gained notoriety for targeting healthcare institutions, as seen in its attacks on organizations in Ireland and New Zealand.
The Conti group has also been known to sell access to victim organizations that have refused to pay the ransom. This practice not only adds another layer of pressure on victims but also provides an additional source of revenue for the ransomware gang. These tactics, combined with the group's sophisticated techniques, have made Conti one of the most prolific and capable ransomware groups operating in 2021.
The software uses its own implementation of AES-256 that uses up to 32 individual logical threads, making it much faster than most ransomware. The method of delivery is not clear.
The gang behind Conti has operated a site from which it can leak documents copied by the ransomware since 2020. The same gang has operated the Ryuk ransomware. The group is known as Wizard Spider and is based in Saint Petersburg, Russia.
Once on a system it will try to delete Volume Shadow Copies. It will try to terminate a number of services using Restart Manager to ensure it can encrypt files used by them. It will disable real time monitor and uninstall the Windows Defender application. Default behaviour is to encrypt all files on local and networked Server Message Block drives, ignoring files with DLL, .exe, .sys and .lnk extensions. It is also able to target specific drives as well as individual IP addresses.
According to NHS Digital the only guaranteed way to recover is to restore all affected files from their most recent backup.
Membership and structure
The most senior member is known by the aliases Stern or Demon and acts as CEO. Another member known as Mango acts as a general manager and frequently communicates with Stern. Mango told Stern in one message that there were 62 people in the main team. The numbers involved fluctuate, reaching as high as 100. Because of constant turnover in members, the group recruits constantly from legitimate job recruitment sites and hacker sites.
Ordinary programmers earn around $1500 to $2000 per month, and members negotiating ransom payments can take a share of the profits. In April 2021 one member claimed to have an unnamed journalist who took a 5% share of ransomware payments by pressuring victims to pay up.
In May 2022, the United States government offered a reward of up to $15 million for information on the group: $10 million for the identity or location of its leaders, and $5 million for information leading to the arrest of anyone conspiring with it.
Affected Industries and Countries
Conti ransomware attacks have been detected across the globe, with the United States experiencing the highest number of attack attempts from January 1 to November 12, 2021, surpassing one million attempts. The Netherlands and Taiwan were ranked second and third, respectively.
The retail industry has been the primary target of Conti attacks, followed by insurance, manufacturing, and telecommunications sectors. Healthcare, which was targeted in high-profile attacks by the Conti group, ranks sixth on the list of affected industries.
History
Origin
Conti is often considered as the successor to Ryuk ransomware.