In less than 2 years, the most successful ransomware group to date has reached new levels of campaign and individual attack effectiveness, targeting over 160 industries worldwide.
Conti has quickly become the most recognizable name in ransomware today. Making up 16% of all ransomware attacks today, Conti has disrupted the operations of over 850 companies, government agencies, and an entire country.
Security vendor Group-IB has recently released an updated look at Conti in their report CONTI ARMADA: ARMATTACK CAMPAIGN. In it, Group-IB note that Conti’s most impressive feat is compromising more than 40 organizations in just one month.
According to the report, Conti have historically focused on 6 industries:
- Manufacturing
- Real Estate
- Transportation
- Professional Services
- Trade
- Consumer Goods
The United States is, by far, their greatest focus, representing 48% of attacks in Q1 of 2022.
Conti’s latest campaign, dubbed ARMATTACK, is characterized as being “lightning fast” by Group-IB. Conti’s speed of execution from initial access to Domain Controller compromise in a little more than 3 days, using a combination of exploits, known malicious toolsets, native Windows remote desktop functionality, and spear phishing. Conti’s successes have not gone unnoticed, with the U.S. Government putting a $15 million bounty on the gang’s head.
And because Conti operates in a “Ransomware as a Service” model, Group-IB see them as a “notorious player that has in fact created an IT company whose goal is to extort large sums.” This makes Conti very dangerous and should cause organizations to increase efforts to stop initial attacks by Conti affiliates through improved defenses, including Security Awareness Training.
