conti logo

conti

1 incidentes 1 paises 1 sectores ransomware RU Ultimo: 2026-06-25
Aliases: Wizard Spider, Gold Ulrick, UNC1878
Ver en IntelTracker → APTTrail →
Conti was a Russia-based ransomware-as-a-service (RaaS) operation that emerged in December 2019, initially operating under the alias Wizard Spider, and is believed to have evolved from the Ryuk ransomware strain. The group's primary motivation was financial gain through cyberattacks and data extortion, generating an estimated $180 million in 2021. Conti distinguished itself through its rapid, multi-threaded data encryption, its adoption of a fixed-wage model for affiliates rather than commission, and its aggressive double extortion tactics. The group was highly organized, often described as operating like a modern corporation. Conti's public allegiance to Russia during the 2022 invasion of Ukraine led to internal chat logs and tools being leaked, contributing significantly to its eventual disbandment in May 2022, though former members subsequently migrated to other cybercrime groups.
Malware asociado
NetSupport, Bazar, Emotet, win.lockfile, BatLoader, Mimikatz
Tecnicas MITRE
T1018, T1552.006, T1547.001, T1553.002, T1074.001, T1480
CVEs relacionadas
CVE-2025-23121, CVE-2025-23120, CVE-2024-4577, CVE-2024-40711, CVE-2024-26169, CVE-2023-41570

RansomLook pivots

Data, inteligencia y referencias externas para contrastar actividad ransomware del actor.

Abrir perfil →
Data
RecentBrowseTrendingStats
Intel
GroupURLsCryptoLeaksNotesAnalysesTorrents
Info
APIGlossaryAbout
Victimas
0
TTPs unicas
0
Info robada historica
N/D
Rescates reclamados
N/D
Pagos detectados
N/D

Paises afectados

United States (1)

Paises objetivo (SOCRadar)

AndorraUnited Arab EmiratesAlbaniaArmeniaAngolaArgentinaAustriaAustraliaAzerbaijanBosnia and Herzegovina

Sectores atacados

Government (1)

Sectores objetivo (SOCRadar)

Construction of BuildingsFood ManufacturingRail TransportationSoftware PublishersReal EstateHospitalsEnterprises & HoldingAccommodationAir TransportationManufacturing

URLs nuevas detectadas en IntelTracker

ransomware.anggipradana.com