Conti was a Russia-based ransomware-as-a-service (RaaS) operation that emerged in December 2019, initially operating under the alias Wizard Spider, and is believed to have evolved from the Ryuk ransomware strain. The group's primary motivation was financial gain through cyberattacks and data extortion, generating an estimated $180 million in 2021. Conti distinguished itself through its rapid, multi-threaded data encryption, its adoption of a fixed-wage model for affiliates rather than commission, and its aggressive double extortion tactics. The group was highly organized, often described as operating like a modern corporation. Conti's public allegiance to Russia during the 2022 invasion of Ukraine led to internal chat logs and tools being leaked, contributing significantly to its eventual disbandment in May 2022, though former members subsequently migrated to other cybercrime groups.

Aliases del actor

Wizard SpiderGold UlrickUNC1878lo que sugiere una red de actividades coordenadasComment PandaPLA Unit 61398TG-8223APT1BrownFoxGroup 3GIF89aShadyRATShanghai GroupByzantine CandorG0006TG-0110APT3BuckeyeUPS TeamGroup 6Boyusec – the Guangzhou Boyu Information Technology CompanyLtdG0023ELMER backdoorGh0stHTRANUNICATPoison IvyPandora“PdPD” (50 64 50 44)un código de marcación para binarios encriptadosrefuerzan la necesidad de monitoreo continuo

Actores similares

Operation DRBControlapt · 0Gamaredon Groupapt · 1[Unnamed group]apt · 0Conquerors Electronic Armyapt · 0Operation Red Signatureapt · 0Predator Pandaapt · 0Eloquent Pandaapt · 0Operation Olympic Gamesapt · 0LUNAR SPIDERapt · 0Turla Groupapt · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker