monti

Executive Summary

Monti is a medium-sophistication criminal ransomware group first seen in December 2022, initially using Conti's leaked source code. Targeting government, legal, and healthcare sectors, Monti has expanded its operations by introducing a new Linux variant in 2023 and experimenting with an affiliate model to increase its attack reach. With 110 known victims and active until May 2025, Monti poses a significant financial threat through ransom demands.

Goals & Targeting

Monti's strategic objectives are centered around organizational-gain through financial exploitation using ransomware. Initially targeting government institutions but shifting to legal and healthcare sectors likely reflects an assessment of high-value targets with significant data or operational downtime stakes. Their affiliate model suggests a focus on expanding their attack capacity and geographic reach to maximize profits and impact.

Monti emerged in late 2022 as a ransomware group, initially leveraging nearly all of Conti's leaked source code to conduct attacks. Unlike many other groups, Monti shifted its primary targets from private-sector businesses to政府机构、法律和医疗 healthcare entities. This pivot was likely an attempt to exploit sectors with potentially higher financial incentives or less robust cybersecurity measures compared to corporate environments. In 2023, Monti released a new Linux variant of their ransomware, signaling an evolution in their operations and reducing reliance on Conti's code, which may have aimed to avoid detection or association with the original group. The introduction of an affiliate program further indicates Monti's strategy to broaden its attack footprint by recruiting others to conduct attacks on their behalf, a common tactic among successful cybercriminal groups to scale operations. With 110 known victims and two published ransom notes, Monti has demonstrated both operational persistence and a clear focus on extorting financial gains from targeted organizations.

Key Capabilities

• Ransomware deployment
• Phishing attacks (using macro-laced documents)
• Domain fronting for command and control communication
• Linux-based ransomware

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Monti's campaigns have targeted critical infrastructure sectors, leveraging their evolving ransomware capabilities. Notable patterns include their affiliate recruitment strategy and the introduction of a Linux variant to diversify attack vectors. With over 110 victims, Monti has demonstrated consistent activity since 2022, adapting their methods to maintain operational effectiveness.

IOC Patterns

• Spear-phishing emails with macro-laced Office documents
• Command-and-control communication via domain fronting
• Linux-based ransomware binaries

Recommended Actions

• Implement robust training programs for users to recognize phishing attempts
• Secure remote desktop protocol (RDP) access and implement multi-factor authentication where possible
• Regularly update and patch systems against known vulnerabilities

Suggested Tags