Cybercrime All About Conti

[Andy Ful]

All About Conti

After REvil dissolved following the Kaseya VSA supply-chain attack in July 2021, the next most prolific ransomware group in 2022 is Conti.

Conti has been in the news consistently since August 2021, warranting a joint warning from the Cybersecurity Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA), bringing to the notice of organizations, the threat posed by the ransomware group and the vulnerabilities it exploits.

CSW data researchers and security analysts cover the latest developments, the tools, techniques, and procedures used, as well as the vulnerabilities explored by Conti in 2021-22 in this blog.

Who is Conti?​

Conti ransomware is a ransomware-as-a-service (RaaS) operation believed to be controlled by the Russia-based cybercrime group called Wizard Spider.
The ransomware shares some of its code with the infamous Ryuk Ransomware, which went off the news in July 2020.

Conti Attacks in 2021​

Let us take a look at the different recent incidents in which the Conti group has been involved in 2021.

​

Ransomware Attack Incident	Time Period	Sector	Conti Demands
Broward County Public School, Florida	March - April 2021	Education	$40M
Exagrid	May 4, 2021	IT	$2.6M
City of Tulsa	May 6 - Present	Government	-
Ireland Health Service Executive (HSE)	May 17 - Present	Healthcare	$20M
Ireland Department of Health	May 18 - Present	Healthcare	Attempt unsuccessful
New Zealand Health Department	May 21 - Present	Healthcare	-
Canada	June end	Internet services	-
Canada	June end	Engineering & Technology	-
Canada	June end	Insurance	-
Stanadyne PurePower Technologies	June 2 - Present	Engineering and Technology	-
SAC Wireless (Nokia subsidiary)	June - August	Manufacturing	250GB data stolen
Microsoft Exchange Servers using ProxyShell	September 3	Software	1 TB data stolen
Covisian	September 18	Communications Industry	-
JVC Kenwood	September - October	Manufacturing	1.7 TB data stolen, $7 Million ransom
Graff	October	Jewelry	69000 files leaked
CS Energy	November 27	Energy	-
Australian Government	November - present	Government	-
Finite Recruitment	December	Government	300 GB data stolen
Nordic Choice Hotels	December 2	Hospitality	-
McMenamins Brewery	December 12	Food and Beverages	-
Shutterfly	December	E-commerce	Few million dollars in ransom

Conti-nuous Attacks Through January 2022​

Conti’s prolific track record continues into 2022, with three attacks being reported–one on a marketing giant, the other on a nationalized bank, and the most recent, on an electronics manufacturing firm.

Full article:

All About Conti

The Conti Group has been one of the most prolific ransomware groups, second only to REvil. At the start of 2021, there were only three vulnerabilities associated with the gang. However, Conti has been on a roll ever since and now has seventeen vulnerability associations. Read on to find out more...

cybersecurityworks.com

​

 

[cruelsister]

The Conti Group just blogged this:

“WARNING”

As a response to Western warmongering and American threats to use cyber warfare against the citizens of Russian Federation, the Conti Team is officially announcing that we will use our full capacity to deliver retaliatory measures in case the Western warmongers attempt to target critical infrastructure in Russia or any Russian-speaking region of the world. We do not ally with any government and we condemn the ongoing war. However, since the West is known to wage its wars primarily by targeting civilians, we will use our resources in order to strike back if the well being and safety of peaceful citizens will be at stake due to American cyber aggression.

 

[Chuck57]

The Conti Group just blogged this:

I read yesterday that Anonymous has gone to war with Russia. Anonymous is alleged to be a worldwide group. Anonymous vs Conti. This has potential to be first rate drama.

 

[The_King]

A Ukrainian security researcher has leaked over 60,000 internal messages belonging to the Conti ransomware operation after the gang sided with Russia over the invasion of Ukraine.

BleepingComputer has independently confirmed the validity of these messages from internal conversations previously shared with BleepingComputer regarding Conti's attack on Shutterfly.

Conti ransomware's internal chats leaked after siding with Russia

An angry member of the Conti ransomware operation has leaked over 60,000 private messages after the gang sided with Russia over the invasion of Ukraine.

www.bleepingcomputer.com

 

[cruelsister]

This has potential to be first rate drama.

Even better is the war between Russian and Ukrainian Troll farms. Note that here as well as in the hacker groups Russian and Ukrainian nationals have always intermingled; but now the latter have rightly turned into ultra Ukrainian nationalists thus becoming the Enemy within. So I wonder how blunted the Russian cyber-war will be.

 

[Gandalf_The_Grey]

Conti Ransomware source code leaked by Ukrainian researcher

A Ukrainian researcher continues to deal devastating blows to the Conti ransomware operation, leaking further internal conversations, as well as the source for their ransomware, administrative panels, and more.

It has been quite a damaging week for Conti after they sided with Russia on the invasion of Ukraine and upset Ukrainian adverts (affiliates) and a researcher who has been secretly snooping on their operation.

Conti Ransomware source code leaked by Ukrainian researcher

A Ukrainian researcher continues to deal devastating blows to the Conti ransomware operation, leaking further internal conversations, as well as the source for their ransomware, administrative panels, and more.

www.bleepingcomputer.com

 

[Shadowra]

Conti Ransomware : I got 2 droppers and they are well detected by the antivirus

VT : 41/72

VirusTotal

VirusTotal

www.virustotal.com

VT : 46/71

VirusTotal

VirusTotal

www.virustotal.com

Edit : Windows Defender (VM)

 

[ichito]

Here is updated list of hack-groups that are involved in war on Ukraine. Conti ransomware is already absent

2022 Russia-Ukraine war — Cyber group tracker. Update 2.

The cyber battle-space of the Ukraine-Russia war 2022 continues to be congested and contested. There are reports today of more overt…

cyberknow.medium.com