New CONTI Ransomware Family Touts Faster Encryption, Better Obfuscation, More Control



iStock-1159448083Just when you thought ransomware couldn’t sport something new, the latest family discovered by VMware’s Threat Analysis Unit shows significant advances in capabilities and execution.

Ransomware has continually evolved over the past years, taking strides to expand its’ reach within a network, to thwart recovery efforts, and even to exfiltrate data. But the latest evolutionary steps uncovered by VMware shows how cybercriminals are thinking about approaching the problems of avoiding detection and improving their encryption efforts.

According to new research from VMware, the CONTI family of ransomware has taken steps to improve the performance of encryption while using new and old methods to ensure success. The more data ransomware can successfully encrypt, the more disruptive the attack, and the higher the likelihood that ransoms will be paid. CONTI uses up to 32 independent threads to simultaneously encrypt data, thereby speeding up the process. And to make certain files to be encrypted are not locked by applications, VMware researchers have spotted a new technique whereby CONTI uses the Windows Restart Manager to cleanly close applications with locked files, allowing those files to be included in the encryption process.

CONTI avoids detection by using 277 unique string encoding algorithms to obfuscate the original code and bloat the simple program into a larger application that is more difficult to identify as the ransomware.

There are tons more cool aspects of this ransomware – stopping 160 known applications that may hinder its’ efforts, command-line control over local vs. network targeting, and more.

This is one very powerful piece of ransomware.

Given CONTI’s ability to avoid detection using a number of methods, relying on security solutions as the primary means of prevention may prove to be less than effective. Organizations need to prevent these new forms of ransomware from ever launching in the first place. By empowering users with Security Awareness Training, users can identify phishing and social engineering tactics being used to trick them into launching malicious content, stopping attacks before they ever start.


Free Ransomware Simulator Tool

Bad guys are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 18 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RanSimScreen-1Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 19 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Subscribe To Our Blog


Ransomware Has Gone Nuclear Webinar




Get the latest about social engineering

Subscribe to CyberheistNews