Ransomware Group Conti Reaches 40 Successful Attacks in a Single Month
In less than 2 years, the most successful ransomware group to date has reached new levels of campaign and individual attack effectiveness, targeting over 160 industries worldwide.
Conti has quickly become the most recognizable name in ransomware today. Making up 16% of all ransomware attacks today, Conti has disrupted the operations of over 850 companies, government agencies, and an entire country.
Security vendor Group-IB has recently released an updated look at Conti in their report CONTI ARMADA: ARMATTACK CAMPAIGN. In it, Group-IB note that Conti’s most impressive feat is compromising more than 40 organizations in just one month.
According to the report, Conti have historically focused on 6 industries:
- Manufacturing
- Real Estate
- Transportation
- Professional Services
- Trade
- Consumer Goods
The United States is, by far, their greatest focus, representing 48% of attacks in Q1 of 2022.
Conti’s latest campaign, dubbed ARMATTACK, is characterized as being “lightning fast” by Group-IB. Conti’s speed of execution from initial access to Domain Controller compromise in a little more than 3 days, using a combination of exploits, known malicious toolsets, native Windows remote desktop functionality, and spear phishing. Conti’s successes have not gone unnoticed, with the U.S. Government putting a $15 million bounty on the gang’s head.
And because Conti operates in a “Ransomware as a Service” model, Group-IB see them as a “notorious player that has in fact created an IT company whose goal is to extort large sums.” This makes Conti very dangerous and should cause organizations to increase efforts to stop initial attacks by Conti affiliates through improved defenses, including Security Awareness Training.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW