Skip to main content
Darkfield

Operator dossier

Conti is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 351 public victims claimed by this operator between July 31, 2020 and June 7, 2022. Conti is a financially-motivated ransomware group that emerged in July 2020 and quickly became one of the most prolific and aggressive ransomware operations globally. The group is suspected to be of Russian origin and operated as a Ransomware-as-a-Service (RaaS) model, with documented ties to the TrickBot malware operation and suspected connections to other Russian cybercriminal enterprises. Conti primarily gained initial access through phishing emails, exploitation of vulnerabilities in internet-facing applications, and leveraging the TrickBot and Emotet botnets for distribution, employing double extortion tactics where they exfiltrated sensitive data before deploying their ransomware and threatening to publish stolen information if ransoms were not paid. Notable campaigns included attacks on Ireland's Health Service Executive (HSE) in May 2021 which severely disrupted healthcare services nationwide, numerous attacks against U.S. healthcare systems during the COVID-19 pandemic, and the breach of Costa Rica's Ministry of Finance and other government agencies in 2022, with the group demanding a $20 million ransom from the Costa Rican government. The Conti operation was significantly disrupted in 2022 following internal leaks of their communications and source code, leading to the group's dissolution, though many of its members are believed to have migrated to other ransomware operations including Black Basta and Karakurt.

Suspected origin: RU (community attribution, not authoritative).

Most-targeted sectors

Most-affected countries

Recent disclosures by Conti

Most recent 150 of 351 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Conti →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Conti

351 victims indexed · first seen 6 years ago · last activity 4 years ago

351
Victims indexed
#25 of 364 tracked operators
1y 11m
Active period
Jul 2020 → Jun 2022
10
Countries hit
top United States · 42

At a glance

Status
inactive
First seen
6 years ago
Last activity
4 years ago
Onion sites
4 known endpoints
Primary sector
Finance · 7 hits
Suspected origin
🇷🇺RU

Attribution

Community-assessed by the MISP threat-intel community — not Darkfield's own attribution.

Attribution confidence
High · 100/100

About

Conti is a financially-motivated ransomware group that emerged in July 2020 and quickly became one of the most prolific and aggressive ransomware operations globally. The group is suspected to be of Russian origin and operated as a Ransomware-as-a-Service (RaaS) model, with documented ties to the TrickBot malware operation and suspected connections to other Russian cybercriminal enterprises. Conti primarily gained initial access through phishing emails, exploitation of vulnerabilities in internet-facing applications, and leveraging the TrickBot and Emotet botnets for distribution, employing double extortion tactics where they exfiltrated sensitive data before deploying their ransomware and threatening to publish stolen information if ransoms were not paid. Notable campaigns included attacks on Ireland's Health Service Executive (HSE) in May 2021 which severely disrupted healthcare services nationwide, numerous attacks against U.S. healthcare systems during the COVID-19 pandemic, and the breach of Costa Rica's Ministry of Finance and other government agencies in 2022, with the group demanding a $20 million ransom from the Costa Rican government. The Conti operation was significantly disrupted in 2022 following internal leaks of their communications and source code, leading to the group's dissolution, though many of its members are believed to have migrated to other ransomware operations including Black Basta and Karakurt.

References

195 links

External sources curated by the MISP threat-intel community.

Timeline

21 months
2020-07-01T00:00:00+00:00 · 12020-09-01T00:00:00+00:00 · 12020-10-01T00:00:00+00:00 · 42020-11-01T00:00:00+00:00 · 12020-12-01T00:00:00+00:00 · 42021-01-01T00:00:00+00:00 · 12021-02-01T00:00:00+00:00 · 22021-03-01T00:00:00+00:00 · 12021-04-01T00:00:00+00:00 · 12021-05-01T00:00:00+00:00 · 12021-06-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 422021-10-01T00:00:00+00:00 · 412021-11-01T00:00:00+00:00 · 542021-12-01T00:00:00+00:00 · 362022-01-01T00:00:00+00:00 · 112022-02-01T00:00:00+00:00 · 342022-03-01T00:00:00+00:00 · 582022-04-01T00:00:00+00:00 · 382022-05-01T00:00:00+00:00 · 182022-06-01T00:00:00+00:00 · 1
2020-07-01T00:00:00+00:002022-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
42
🇩🇪 Germany
11
🇮🇹 Italy
8
🇬🇧 United Kingdom
8
🇳🇱 Netherlands
2
🇨🇦 Canada
2
🇫🇷 France
2
🇳🇴 Norway
2
United States dossier →Germany dossier →Italy dossier →United Kingdom dossier →

Top sectors

Finance
7
Energy
6
Healthcare and Public Health
6
Manufacturing
6
Food & Agriculture
4
Healthcare
3
Transportation Systems
3
Government Facilities
3
Finance dossier →Energy dossier →Healthcare and Public Health dossier →Manufacturing dossier →

MITRE ATT&CK

18 techniques · 10 tactics

Tactics

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact

Techniques

Detection · YARA rules

1 rule

  • ransom_conti

    YARA rule from ATR/Trellix: ransomware/Ransom_Conti.yar

    source: ATR/Trellix

Recent victims

Loading…

Onion infrastructure

4 known
  • http://continews.bz
  • http://continews.click
  • http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion
  • http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Conti posts a victim.

Add Conti to your watchlist — Pro pings you within 5 minutes of any new Conti leak-site post, Telegram callout, or affiliate-rebrand inference.