Conti

Category: ransomware · Aliases: Conti Ransomware, Conti.News, Trojan.Ransom.Conti, Win32/Conti, Wizard Spider Conti · Sample count (EMBER 2018): 180 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: RansomwareStatus: Automated SignaturePlatform: WINDOWS, LINUX, VMWARE_ESXIStage: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Exfiltration, Impact🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Windows 11, Windows 10, Windows Server 2022
Executive Summary
Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wizard Spider from early 2020 until its public splintering in mid-2022.

Table of Contents

Overview

Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wizard Spider from early 2020 until its public splintering in mid-2022. Emerging as the operational successor to Ryuk, Conti operated an enterprise-grade Ransomware-as-a-Service (RaaS) model backed by full-time software developers, HR recruiters, OSINT researchers, and negotiators. Conti engineered a remarkably fast multi-threaded encryption engine: utilizing 32 concurrent worker threads, it achieves rapid parallel encryption using ChaCha20 stream cipher for data blocks combined with an embedded 4096-bit RSA public key to protect the session keys. Conti was staged via elite initial-access loaders, including TrickBot, BazarLoader, and Bumblebee, and weaponized Active Directory vulnerabilities such as Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) for rapid enterprise-wide privilege escalation. The group pioneered aggressive double-extortion tactics, leaking stolen corporate data on their 'Conti.News' dark web portal. Conti famously attacked over 1,000 organizations, including healthcare networks, law enforcement agencies, and the national infrastructure of Costa Rica, prompting the Costa Rican government to declare a national state of emergency in May 2022. Following their public pledge of allegiance to the Russian state in February 2022, an anonymous researcher leaked thousands of internal Jabber chat logs ('ContiLeaks'), exposing their corporate organizational chart, bitcoin wallets, and source code. CISA published Alert AA21-265A detailing Conti technical indicators and defensive mitigations.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Ryuk · Hermes

Known Derivatives & Downstream Variants: Conti_V1 · Conti_V2 · Conti_V3 · Blackcat_Alphv_Offshoot · Quantum_Ransomware

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 · T1490 · T1021.002 · T1059.001 · T1068 · T1003.001 · T1071.001 · T1547.001 · T1041

→ Explore the complete 226-Technique ATT&CK Threat Matrix

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-LSALSA Protection & Credential GuardHardenT1003.001Enable Windows LSA RunAsPPL (Protected Process Light) and Credential Guard to prevent memory dumping of lsass.exe.
D3-NBANetwork Behavioral AnalysisDetectT1021.002Enforce SMB message signing, disable legacy SMBv1, and restrict administrative share access (C$, ADMIN$) to dedicated PAM bastion hosts.
D3-EAFEgress Analysis and FilteringIsolateT1041Enforce perimeter TLS inspection and alert on anomalous outbound data volume ratios transmitting over active C2 channels.
D3-PSBLPowerShell Script Block LoggingDetectT1059.001Enable PowerShell event ID 4104 and Constrained Language Mode to neuter obfuscated script payloads.
D3-KPAKernel Patching & Privilege AuditingHardenT1068Enforce rapid OS kernel patch cycles and deploy Exploit Guard protections to block memory corruption and elevation exploits.
D3-WAFWeb Content Filtering & InspectionFilterT1071.001Block newly registered domains (NRDs) and inspect HTTP Host and URI headers for known C2 profiles.
D3-FAEDFile Alteration Early DetectionDetectT1486Deploy canary files and monitor mass rename/encryption I/O spikes to terminate ransomware threads immediately.
D3-VSSVolume Shadow & Snapshot HardeningHardenT1490Block execution of vssadmin.exe and wmic shadowcopy delete; maintain air-gapped immutable backup repositories.
D3-RPMRegistry Persistence MonitoringDetectT1547.001Audit and restrict write privileges to user and machine-level Registry Run/RunOnce keys using Endpoint Privilege Management.

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_CONTI_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conti"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "conti" ascii wide nocase
        $s2 = "conti ransomware" ascii wide nocase
        $s3 = "conti.news" ascii wide nocase
        $s4 = "trojan.ransom.conti" ascii wide nocase
        $s5 = "win32/conti" ascii wide nocase
        $s6 = "wizard spider conti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Conti (Ransomware) Execution & Triage
id: 0b62cf1d-a4bf-52b0-804e-93fb0b95c81a
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Conti malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/conti
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1490
- attack.t1021_002
- attack.t1059_001
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_CONTI_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conti tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "conti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA21-265A ↗

Frequently Asked Questions

What is Conti ransomware and who operated it?

Conti was a dominant Ransomware-as-a-Service operation active between 2020 and 2022, operated by the Russian cybercrime group Wizard Spider as the technological successor to Ryuk.

What made Conti's encryption engine so fast?

Conti utilized 32 concurrent worker threads to execute multi-threaded parallel encryption using the ChaCha20 stream cipher, allowing it to encrypt entire corporate file servers in minutes.

What happened during the 2022 Costa Rica ransomware attack?

In May 2022, Conti hit 27 government ministries in Costa Rica, disrupting customs, healthcare, and tax systems, prompting the President of Costa Rica to declare a national state of emergency.

What were the 'ContiLeaks'?

In March 2022, after Conti declared support for the Russian invasion of Ukraine, an insider leaked two years of internal chat logs, source code, and training materials, exposing the syndicate's operational structure.

What guidance is provided in CISA Alert AA21-265A?

CISA Alert AA21-265A outlines indicators of compromise, network hunting rules for TrickBot and BazarLoader, and mitigations including multi-factor authentication, network segmentation, and endpoint detection.

How did Conti utilize multithreading and Windows I/O completion ports for lightning-fast encryption?

Conti was renowned for being one of the fastest ransomware strains ever analyzed. It leveraged Windows I/O Completion Ports (IOCP) paired with 32 concurrent worker threads per CPU core to queue and process file encryption tasks asynchronously. This allowed Conti to encrypt local and mapped network shares simultaneously, completing enterprise-scale encryption in minutes before defensive responders could intervene.

What role did BazarLoader and Cobalt Strike play in Conti's initial intrusion and lateral movement pipeline?

Conti operators relied on a standardized enterprise intrusion kill-chain. Initial access was predominantly brokered via phishing campaigns dropping BazarLoader or TrickBot. Once established, operators deployed Cobalt Strike Beacon to conduct internal network mapping, execute BloodHound domain audits, and harvest LSASS credentials, culminating in PsExec or WMI-driven distribution of the final Conti binary.

What key YARA hunting rules and Sigma signatures detect Conti execution in SIEM/EDR platforms?

Detection rules for Conti focus on its characteristic pre-encryption actions: terminating system services (such as Acronis, Veeam, SQL, and Exchange) via NetStop or TaskKill commands, executing 'vssadmin delete shadows /all /quiet', and querying open network shares via NetShareEnum. YARA rules match on Conti's unique string decryption routines, mutex formatting strings, and ransom note generation templates (readme.txt).

How do I remove the Conti Ransomware from Windows?

Manual removal of Conti is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Conti a virus or a Ransomware?

Conti is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Conti typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Conti infection?

Symptoms of Conti can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Ransomwares

Want to prevent Conti and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Containment & Incident Response.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/conti.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.