Log in Request a demo

Malware profile

Conti

Conti is ransomware that steals a victim's files, encrypts Windows systems and then demands payment.

In short

Conti is ransomware that steals a victim's files, encrypts Windows systems and then demands payment. MITRE describes it as a ransomware as a service operation first observed in December 2019. US agencies counted more than 1,000 attacks by February 2022.

Last updated 8 October 2026

Profile MapMalware
  1. Names1names in public reportsConti
  2. Techniques15ATT&CK techniques listedExecution · Stealth · Privilege Escalation

In one minute

What it is
Ransomware that steals data, encrypts Windows systems and demands a ransom, run as a ransomware as a service operation.
What it does
Looks around the network, stops security and backup services, deletes shadow copies, then encrypts files quickly and threatens to publish stolen data.
Who uses it
Attributed by MITRE ATT&CK to the group it names Wizard Spider. The US Department of Justice, in indictments unsealed on 7 September 2023, alleges four named Russian nationals conspired to use Conti.
How it gets in
Phishing, stolen or weak RDP credentials, phone calls, fake software, other malware such as TrickBot and ZLoader, and flaws in external systems, as listed by CISA, FBI and NSA.
What to do first
Require multifactor authentication for remote access, restrict RDP, segment the network and keep software updated, as CISA, FBI and NSA advise.

What it does

MITRE says Conti has been used against major corporations and government agencies, particularly in North America. Before it encrypts, it looks around the network, stops many security and backup services, and deletes Windows shadow copies that could help recovery.

CISA, FBI and NSA say Conti does not follow the usual affiliate model. It is likely that the developers pay the people who deploy it a wage, rather than a percentage of the proceeds. The advisory also says Conti actors often use the open-source Rclone program to steal data, then use double extortion: they demand a ransom and threaten to publish the data.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
ContiMITRE ATT&CK software S0575 and CISA, FBI and NSA advisory AA21-265A[1, 2]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Execution

  • Command and Scripting Interpreter: Windows Command Shell T1059.003

    Command line options let the operator control how it scans and encrypts files.[1, 2]

  • Native API T1106

    Calls Windows API functions while it runs.[1, 2]

Stealth

  • Obfuscated Files or Information T1027

    Uses compiler-based obfuscation, encrypts DLLs and hides Windows API calls.[1]

  • Deobfuscate/Decode Files or Information T1140

    Decrypts its own payload with a key built into the program.[1]

Privilege Escalation

  • Process Injection: Dynamic-link Library Injection T1055.001

    Loads an encrypted DLL into memory and then runs it.[1]

Discovery

  • Remote System Discovery T1018

    Can find other hosts on the target network.[1]

  • Network Share Discovery T1135

    Lists open SMB shares on other machines.[1]

  • Process Discovery T1057

    Goes through open processes looking for names that contain "sql".[1]

  • System Network Configuration Discovery T1016

    Reads the local ARP cache and checks that the addresses it connects to are local systems, not Internet ones.[1]

  • File and Directory Discovery T1083

    Finds files on the local system.[1]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    Spreads over SMB and encrypts files on other hosts, which can affect a whole network.[1]

  • Taint Shared Content T1080

    Infects other machines through network shared drives.[1]

Impact

  • Data Encrypted for Impact T1486

    Encrypts files in parallel to be fast, skips .exe, .dll and .lnk files, uses a different key per file, and uses Windows Restart Manager so files are unlocked.[1]

  • Service Stop T1489

    Can stop up to 146 Windows services tied to security, backup, database and email.[1]

  • Inhibit System Recovery T1490

    Deletes Windows Volume Shadow Copies.[1, 2]

How it spreads

MITRE says Conti has been deployed via TrickBot, and that it can spread inside a network over SMB and network shared drives. CISA, FBI and NSA say Conti actors often get in through tailored phishing emails with malicious attachments or links, stolen or weak RDP credentials, phone calls, fake software promoted through search engine optimization, other malware networks such as ZLoader, and common vulnerabilities in external assets. Once inside, they use tools already on the victim network, and add tools such as Mimikatz, to gather credentials and move across the network. The advisory says that, according to a leaked actor playbook, they also exploit unpatched flaws, including old SMB 1.0 server flaws, CVE-2021-34527 (PrintNightmare) and CVE-2020-1472 (Zerologon).

Timeline

  1. December 2019

    First observed

    MITRE says Conti was first observed in December 2019.[1]

  2. 2020

    Conti conspiracy begins

    A US indictment says the Conti conspiracy ran from 2020 until June 2022.[4]

  3. 1 May 2021

    Attack on a US health system

    A US indictment names this Conti attack on this date.[4]

  4. 22 September 2021

    Joint advisory AA21-265A

    CISA, FBI and NSA published their Conti advisory. At that point they had seen Conti used in more than 400 attacks.[2]

  5. October 2021

    Access sales

    CISA says Conti actors began selling access to victims' networks, enabling attacks by other actors.[3]

  6. 28 February 2022

    Attack count updated

    The advisory was updated to say reported Conti attacks had risen to more than 1,000.[2]

  7. 9 March 2022

    Indicators added

    The advisory was updated with indicators of compromise and the US Secret Service as a co-author.[2]

  8. 7 September 2023

    Indictments unsealed

    The US Department of Justice unsealed indictments covering Trickbot and Conti, including charges against four Russian nationals over Conti.[4]

  9. 30 October 2025

    Extradition from Ireland

    The Department of Justice announced a Ukrainian man had been extradited from Ireland on a 2023 Conti indictment.[5]

  10. 12 June 2026

    Guilty plea

    The Department of Justice announced the same man had pleaded guilty to conspiracy to commit wire fraud over Conti.[6]

Detection and defense

  1. Require multifactor authentication

    Require multifactor authentication for remote access from outside. If RDP is truly needed, limit where it can be reached from and require multifactor authentication.[2]

    Counters: T1078 T1133

  2. Segment the network

    Separate networks and functions, with a demilitarized zone, so ransomware cannot spread freely.[2]

    Counters: T1021.002 T1080

  3. Block phishing

    Use strong spam filters, filter emails with executable files, train users, and disable macro scripts in Office files from email.[2]

    Counters: T1566.001 T1566.002

  4. Patch and scan

    Keep operating systems, applications and firmware updated, and run regular scans. The advisory names old SMB 1.0 flaws, CVE-2021-34527 and CVE-2020-1472 as ways Conti actors move across networks.[2]

    Counters: T1021.002

  5. Remove unneeded remote tools

    Remove applications not needed for daily work, investigate unauthorized remote desktop or remote monitoring software, and use application allowlisting.[2]

    Counters: T1133 T1059.003

  6. Use endpoint detection and response

    These tools give a high degree of visibility into endpoints, which helps to spot discovery, service stopping and encryption steps.[2]

    Counters: T1489 T1490 T1486

  7. Prepare for recovery

    Scan backups for malware, follow the Ransomware Response Checklist and report incidents to CISA, the FBI or the Secret Service. The agencies strongly discourage paying a ransom.[2]

    Counters: T1486 T1490

  8. Use the official detection resources

    CISA, FBI and NSA advisory AA21-265A links to indicators of compromise in STIX format, and its March 2022 update lists domains with characteristics similar to those used by groups that distributed Conti.[2]

    Counters: T1486

Questions

What is Conti?

Conti is ransomware that steals data, encrypts Windows systems and demands a ransom. MITRE calls it a ransomware as a service and says it was first observed in December 2019.

How does Conti get into a network?

CISA, FBI and NSA list tailored phishing emails, stolen or weak RDP credentials, phone calls, fake software, other malware networks and common flaws in external systems. MITRE says it has been deployed via TrickBot.

How many attacks has Conti been used in?

Sources differ on the count and the date. CISA reported more than 400 attacks in September 2021 and more than 1,000 by February 2022. The Department of Justice said more than 900 victims in September 2023 and more than 1,000 in October 2025. The FBI estimates at least $150 million in ransom payments as of January 2022.

Has anyone been charged over Conti?

Yes. In September 2023 the Department of Justice unsealed an indictment charging four Russian nationals over Conti. A Ukrainian man was extradited from Ireland in October 2025 and, the Department said in June 2026, pleaded guilty to conspiracy to commit wire fraud.

What should a defender do first?

CISA, FBI and NSA advise multifactor authentication for remote access, network segmentation and keeping software updated. They also advise restricting RDP.

In our research

  1. What Should You Know About Ransomware September 2022

Sources

  1. Conti, Software S0575 MITRE ATT&CKSupports: Description, platform, first observed date, techniques and the group MITRE lists.
  2. Conti Ransomware (AA21-265A) CISA, FBI and NSASupports: Entry routes, tools, double extortion, mitigations and detection resources.
  3. 2021 Trends Show Increased Globalized Threat of Ransomware (AA22-040A) CISA, FBI, NSA and partnersSupports: Conti actors began selling access to victims in October 2021.
  4. Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies US Department of JusticeSupports: Indictments of 7 September 2023, victim count and the link to Trickbot.
  5. Ukrainian National Extradited from Ireland in Connection with Conti Ransomware US Department of JusticeSupports: Extradition of 30 October 2025, victim count and FBI ransom estimate.
  6. Ukrainian National Pleads Guilty to Wire Fraud Conspiracy in Connection with Conti Ransomware US Department of JusticeSupports: Guilty plea announced 12 June 2026.
  7. Wizard Spider, Group G0102 MITRE ATT&CKSupports: MITRE lists Wizard Spider as a user of Conti.

Browse the threat library

Keep exploring

Knowledge Hub

Article

What Should You Know About Ransomware

Ransomware is an easy way to profit since attackers directly demand ransom. They do not have to infiltrate sensitive data and sell them to…

Read more

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more

Industry

Government and public sector

State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.

Read more