Threat intelligence / Malware

Conti

[Conti](https://attack.mitre.org/software/S0575) is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019. [Conti](https://attack.mitre.org/software/S0575) has been deployed via [TrickBot](https://attack.mitre.org/software/S0266) and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors using [Conti](https://attack.mitre.org/software/S0575) steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)(Citation: Cybleinc Conti January 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Conti](https://attack.mitre.org/software/S0575) is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019. [Conti](https://attack.mitre.org/software/S0575) has been deployed via [TrickBot](https://attack.mitre.org/software/S0266) and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors using [Conti](https://attack.mitre.org/software/S0575) steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)(Citation: Cybleinc Conti January 2020)

Labels

malware

18 recorded

Relationships

uses

from C0015

Campaign

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Service Stop

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Taint Shared Content

Technique

uses

to Windows Command Shell

Technique

uses

from Wizard Spider

Group

5 external

References

mitre-attack

S0575

Conti

—

CarbonBlack Conti July 2020

https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/

Cybleinc Conti January 2020

https://cybleinc.com/2021/01/21/conti-ransomware-resurfaces-targeting-government-large-organizations/

Cybereason Conti Jan 2021

https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware