Threat intelligence / Campaign

C0015

[C0015](https://attack.mitre.org/campaigns/C0015) was a ransomware intrusion during which the unidentified attackers used [Bazar](https://attack.mitre.org/software/S0534), [Cobalt Strike](https://attack.mitre.org/software/S0154), and [Conti](https://attack.mitre.org/software/S0575), along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated [Conti](https://attack.mitre.org/software/S0575) ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[C0015](https://attack.mitre.org/campaigns/C0015) was a ransomware intrusion during which the unidentified attackers used [Bazar](https://attack.mitre.org/software/S0534), [Cobalt Strike](https://attack.mitre.org/software/S0154), and [Conti](https://attack.mitre.org/software/S0575), along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated [Conti](https://attack.mitre.org/software/S0575) ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)

39 recorded

Relationships

uses

Tool

uses

Malware

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

Malware

uses

to Data Encrypted for Impact

Technique

uses

to Data from Local System

Technique

uses

to Data from Network Shared Drive

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Domain Groups

Technique

uses

to Domain Trust Discovery

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Local Groups

Technique

uses

to Malicious File

Technique

uses

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

Tool

uses

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote Desktop Software

Technique

uses

to Remote System Discovery

Technique

uses

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Time Discovery

Technique

uses

Technique

uses

to Visual Basic

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

C0015

DFIR Conti Bazar Nov 2021

https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/