Threat Actor Characterization
Conti
ID: 335248f18d8d9f97618415474cba59ba58085
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Conti is a ransomware family and RaaS ecosystem historically active since 2019/2020, associated with enterprise-focused intrusions featuring credential abuse, discovery, lateral movement, data theft for extortion, recovery inhibition (shadow copy deletion), service disruption, and encryption for impact. Mapping emphasizes behaviors and pre-impact signals; affiliate infrastructure and tooling vary across incidents.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1059.003 | Windows Command Shell | TA0002 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
| T1490 | Inhibit System Recovery | TA0040 |
|
| T1489 | Service Stop | TA0040 |
|
| T1135 | Network Share Discovery | TA0007 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
| T1018 | Remote System Discovery | TA0007 |
|
| T1083 | File and Directory Discovery | TA0007 |
|
| T1057 | Process Discovery | TA0007 |
|
| T1027 | Obfuscated Files or Information | TA0005 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1560 | Archive Collected Data | TA0009 |
|
Conti — Human-operated ransomware & data-extortion program (ecosystem fragmentation post-2022 leaks)
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Cybercrime / Ransomware & Extortion — Origin: INFERENCE (confidence: high): Russian-speaking cybercrime ecosystem
Author: iQBlack CTI Team
Executive Summary
Conti was one of the most prolific “human-operated” ransomware-and-extortion programs, characterized by rapid encryption capability, aggressive double-extortion pressure, and businesslike internal processes described in leaked internal materials from early 2022. A joint government advisory describes repeated use of phishing and credential-based access, post-exploitation frameworks (e.g., Cobalt Strike), credential theft tooling, lateral movement via SMB/admin shares, and exfiltration using rclone.
In late February 2022, a public pro-Russia statement preceded an unprecedented leak of Conti internal chats, documents, and code, which many analysts assess as a major inflection point leading to operational disruption and subsequent fragmentation/rebranding. Defenders should therefore model “Conti” as both (a) a historic brand and (b) a durable tradecraft bundle that persists across successor clusters.
- Industries / Sectors: Broad, with significant victimization in healthcare, public sector, and large enterprises in open reporting; the joint CSA notes hundreds of attacks and a range of intrusion vectors.
- Geography: Global exposure; advisory focus includes U.S. and international organizations.
- Timeframe: Prominent activity from 2020–2022, with tactical legacy persisting in later ransomware ecosystems (INFERENCE, confidence: high).
