What was Conti ransomware?

Conti was one of the most active ransomware operations of 2020 to 2022. In joint advisory AA21-265A of 22 September 2021, CISA, the FBI and the NSA reported more than 400 attacks on US and international organisations, with affiliates getting in through spear phishing, stolen or weak remote-desktop credentials, fake software downloads and known vulnerabilities; the advisory was later updated with further indicators. Conti operated more like a company than a loose network, with paid staff, which became visible in February 2022 when tens of thousands of its internal chat messages leaked. The brand shut down around mid-2022, and its members spread into other ransomware and extortion operations. For defenders, the leaked material confirmed what the advisories said: most intrusions relied on ordinary weaknesses such as missing MFA, exposed remote access and slow patching, not on exotic exploits.

← All 25 questions on Ransomware groups and familiesAll topics