Conti (ransomware)

Conti is malware developed and first used by the Russia-based hacking group "Wizard Spider" in December, 2019. It has since become a full-fledged ransomware-as-a-service (RaaS) operation used by numerous threat actor groups to conduct ransomware attacks.

Conti malware, once deployed on a victim device, not only encrypts data on the device but also spreads to other devices on the network, obfuscates its presence, and provides a remote attacker control over its actions on the objective. All versions of Microsoft Windows are known to be affected. The United States government offered a reward of up to $10 million for information on the group in early May 2022.

Description

RaaS model

According to a leaked playbook, core team-members of a Conti operation manage the malware itself, while recruited affiliates are tasked with exploitation of victim networks and encryption of their devices.

Conti's ransomware as a service model varies in its structure from a typical affiliate model. Unlike other RaaS models, groups using the Conti model likely pay deployers of the malware in wages rather than in a percentage of the ransom (once paid). Conti operators have also been known to use double-extortion as a means to pressure victims into paying, including publishing the victim's stolen data. In cases where a victim organization refuses to pay, they have sold access to the organization to other threat actors.