Conti

Executive Summary

Conti is an advanced ransomware-as-a-service weapon first seen in December 2019, commonly delivered via the TrickBot trojan to large corporations and governmental organizations across North America. After exfiltrating data, it encrypts files with AES‑256 and threatens public disclosure if ransoms are not paid. The malware utilizes HTTPS-based dynamic C2 for stealthy updates, modifies registry entries for persistence, and disables common security utilities. Its dual threat model—encryption plus extortion—makes Conti a high‑impact ransomware actor requiring robust monitoring and defense practices.

Conti is a sophisticated ransomware-as-a-service (RaaS) platform first detected in December 2019. The operation is tightly integrated with the TrickBot trojan, which delivers Conti to compromised Windows networks through credential theft, phishing drops or supply‑chain compromise. Once activated, Conti exfiltrates sensitive files and metadata before encrypting them with strong AES‑256 encryption, then appends .conti to the original filenames. The malware’s command‑and‑control (C2) infrastructure uses HTTPS connections to a dynamic DNS list, allowing attackers to update their servers without being easily blocked. In 2020 and 2021, Conti leveraged public cloud storage services such as Dropbox and Amazon S3 to host ransomware payloads and ransom notes. Attackers also exploited the popular RAT tool, Mimikatz, for credential dumping, enabling lateral movement across corporate environments. The group's focus has been major corporations and government agencies in North America, where they have threatened to publish exfiltrated data unless a payment is made. These tactics emphasize the double‑layered threat model of Conti: ransom for file recovery coupled with extortion through potential data leaks. Conti’s persistence mechanisms include modifying registry keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and creating malicious scheduled tasks. The malware can disable security tools such as Windows Defender by terminating related processes, further facilitating its spread and encryption operations. Overall, Conti demonstrates a classic RaaS model of rapid deployment, aggressive exfiltration, and financially motivated cryptography.

Key Capabilities

• Delivery via TrickBot trojan
• Exfiltration of sensitive files before encryption
• AES‑256 file encryption with .conti suffix
• HTTPS-based dynamic C2 for updates
• Persistence through registry Run keys and scheduled tasks
• Disables security utilities such as Windows Defender
• Leverages Mimikatz for credential dumping

ATT&CK Techniques

Recommended Actions

• Implement network segmentation to limit lateral movement
• Block known Conti and TrickBot domains/IPs at the perimeter
• Enable file integrity monitoring on critical directories
• Use EDR solutions that detect file encryption activity and anomalous C2 traffic
• Ensure timely patching of Windows vulnerabilities Maintain secure, offline backups of critical data
• Educate staff on spear‑phishing to prevent initial compromise Utilize threat hunting scripts targeting known Conti indicators such as process names, registry keys, and encrypted file patterns

Suggested Tags