Article
WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations
Wizard Spider profile: aliases such as FIN12 and GOLD BLACKBURN, activity since 2016, and its role in TrickBot, Ryuk, Conti and Black Basta operations.
Read more
Ransomware group profile
Conti ransomware group
Also known as Wizard Spider (per Rewards for Justice and the UK government)
Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK.
- Inactive
In short
Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. A joint advisory (AA21-265A) from CISA, the FBI and the NSA, first published September 22, 2021, says it hit U.S. and international organizations in more than 400 attacks at first and above 1,000 by March 2022. The U.S. Department of Justice says the conspiracy ran until about June 2022.
- StatusInactiveas reported
- Other Names1names in public reports
- Entry Routes4ways inStolen or weak RDP logins
- Techniques5mapped to MITRE ATT&CKData Encrypted for Impact · Valid Accounts
- Defences7first steps listedSegment the network · Limit and protect RDP
Overview
Conti was a ransomware group that ran as a ransomware as a service (RaaS) business. MITRE ATT&CK says it was first observed in December 2019. In a RaaS, developers write the ransomware and others deploy it. CISA says Conti differs from the usual model. It is likely that Conti developers pay the people who deploy the ransomware a wage, rather than a share of each ransom.
Scale as officials state it
The first CISA, FBI and NSA advisory (AA21-265A, September 22, 2021) counted more than 400 attacks on U.S. and international organizations. When it was re-released on March 9, 2022, CISA said reported attacks had risen to more than 1,000. The U.S. Department of Justice later said Conti was used against more than 1,000 victims worldwide and that, per the FBI, ransom payments were at least 150 million US dollars as of January 2022. The FBI also says that in 2021 Conti hit more critical infrastructure victims than any other ransomware variant.
- December 2019First observedMITRE ATT&CK dates the first sighting of Conti to this month.
- September 22, 2021Joint advisoryCISA, the FBI and the NSA publish AA21-265A.
- February 2022Support for RussiaRewards for Justice says Conti operators pledged support to the Russian government after the invasion of Ukraine.
- March 9, 2022Advisory updatedNew indicators are added and CISA reports more than 1,000 attacks.
- June 2022End of charged activityThe U.S. indictment covers Conti activity from 2020 to about June 2022.
- February 9, 2023UK and US sanctionsSeven people linked to the Trickbot gang are sanctioned. The UK release names Conti among the groups.
- September 7, 2023U.S. indictmentsThe Department of Justice unseals three indictments tied to Trickbot and Conti.
- October 30, 2025ExtraditionA Ukrainian man arrested in Ireland in July 2023 is extradited to the United States.
How it works
Conti actors got in through tailored phishing emails, stolen or weak Remote Desktop Protocol (RDP) logins, fake software promoted through search results, and flaws in internet-facing systems. Once inside, they used tools already on the network and added others such as Mimikatz, a tool that steals passwords, and Cobalt Strike, a tool attackers use to control a network. CISA names Trickbot, a malware family, as a common way in. The actors used Rclone, a file copy tool, to move data out. The ransomware can stop up to 146 Windows services and delete the built-in restore points before it encrypts.
CISA also cites a leaked Conti playbook that lists flaws used to move around inside a network: PrintNightmare (CVE-2021-34527), Zerologon (CVE-2020-1472) and old Windows file sharing flaws.
Link to other crime groups
Rewards for Justice describes Conti as a Russian government-linked group and says it targeted U.S. and Western critical infrastructure. The UK government and U.S. Treasury sanctioned members of the Trickbot gang in February 2023. In September 2023 the Department of Justice charged nine Russian nationals over Trickbot and four of them over Conti. The UK release lists the Irish Health Service Executive and the Costa Rican government among recent ransomware victims. We cover the Irish case in our HSE incident profile.
Law enforcement action
Rewards for Justice offers up to 10 million US dollars for information on people linked to Conti. Trickbot, which supported Conti, was taken down in 2022, per the Department of Justice. On October 30, 2025 the Department said a Ukrainian man had been extradited from Ireland on a 2023 Conti indictment.
- Main advisory
- AA21-265A, September 22, 2021, updated March 9, 2022
- First observed
- December 2019 (MITRE ATT&CK)
- Attacks counted
- More than 1,000 by March 2022 (CISA)
- Ransom payments
- At least 150 million USD to January 2022 (FBI estimate)
- Largest demand
- As high as 25 million USD (Rewards for Justice)
- Also known as
- Wizard Spider (Rewards for Justice, UK government)
- Charged activity
- 2020 to about June 2022 (Department of Justice)
Also known as
- Wizard Spider (per Rewards for Justice and the UK government)
How they get in
-
01
Phishing with malicious attachments or links
CISA lists tailored spearphishing emails with malicious attachments. Documents often drop Trickbot, IcedID or Cobalt Strike for later stages.
-
02
Stolen or weak RDP logins
Conti actors were seen using stolen or weak Remote Desktop Protocol credentials to enter victim networks.
-
03
Fake software and other malware networks
CISA names fake software promoted through search engine optimization and other malware distribution networks such as ZLoader.
-
04
Flaws in internet-facing systems
CISA lists common vulnerabilities in external assets. Inside the network, the leaked playbook names PrintNightmare (CVE-2021-34527) and Zerologon (CVE-2020-1472) for spreading.
How they extort
Double extortion, per CISA: files are stolen and servers and workstations are encrypted. The victim is told to pay for the release of the data and is threatened with public release if it does not. Rewards for Justice says the stolen data is sold or published on a leak site if the ransom is not paid, and that some demands reached 25 million US dollars.
Who they target
-
01
Healthcare
See the industry page -
02
Government and public sector
See the industry page -
03
Emergency services and first responders
-
04
Financial services
See the industry page
Tools and malware
- Malware Cobalt Strike Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks. Legitimate tool abused · Since 2012 · Linux, macOS, Windows
- Malware Conti Conti is ransomware that steals a victim's files, encrypts Windows systems and then demands payment. Ransomware · Since 2019 · Windows
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Notable incidents
How to defend
-
Require multifactor authentication for remote access
CISA, FBI and NSA say to require multifactor authentication to remotely access networks from external sources.
-
Segment the network
Keep networks and functions apart, and define a demilitarized zone, to reduce the spread of the ransomware.
-
Limit and protect RDP
Where RDP is needed, restrict the originating sources and require multifactor authentication.
-
Patch and remove what is not needed
Keep operating systems, applications and firmware up to date. Remove applications not needed for daily work, and investigate unauthorized remote monitoring or remote desktop software.
-
Allowlist applications and block macros
Allow only approved programs to run and disable macro scripts in email attachments.
-
Audit admin accounts
Regularly audit administrative accounts, apply least privilege and check logs for new accounts.
-
Prepare for infection
Scan backups for malware, report incidents to CISA, the FBI or the Secret Service, and follow the ransomware response checklist. The agencies strongly discourage paying a ransom.
Questions
What was the Conti ransomware group?
Conti was a ransomware as a service group that MITRE ATT&CK says was first observed in December 2019. Developers ran the ransomware and others deployed it. CISA says Conti developers likely paid deployers a wage rather than a share of each ransom.
How did Conti get into networks?
Per CISA, Conti actors used tailored phishing emails, stolen or weak Remote Desktop Protocol logins, fake software promoted through search results, and flaws in internet-facing systems. Trickbot malware was also named as a common way in.
How many attacks did Conti carry out?
The first CISA, FBI and NSA advisory counted more than 400 attacks. When it was re-released on March 9, 2022, CISA said reported attacks had passed 1,000. The Department of Justice also cites more than 1,000 victims worldwide.
Is Conti still active?
The page lists Conti as inactive. The U.S. indictment covers Conti activity from 2020 to about June 2022. Sanctions and indictments followed in 2023, and a Ukrainian man was extradited to the United States on October 30, 2025.
What is Conti also known as?
Rewards for Justice and the UK government describe Conti as also known as Wizard Spider. Rewards for Justice offers up to 10 million US dollars for information on people linked to the group.
In our research
- WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
- How Ransomware Groups Evolve in Time and What to Expect in the Future October 2022
- Wizard Spider Threat group
Sources
- Conti Ransomware (AA21-265A) CISA, FBI, NSA, USSS
- Updated: Conti Ransomware CISA
- Conti, Software S0575 MITRE ATT&CK
- Conti reward offer Rewards for Justice
- UK cracks down on ransomware actors UK Government
- United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang U.S. Department of the Treasury
- Multiple foreign nationals charged in connection with Trickbot malware and Conti ransomware U.S. Department of Justice
- Ukrainian National Extradited from Ireland in Connection with Conti Ransomware U.S. Department of Justice
- Financial Trend Analysis: Ransomware FinCEN
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.