Malware
malware:conti
Also: Conti ransomware
Ransomware referred to as being staged on Dominican Republic systems and associated with a Conti command-and-control server.
Ransomware referred to as being staged on Dominican Republic systems and associated with a Conti command-and-control server.
“the Conti ransomware on these systems”
“We found out that the threat actor was on the systems over ten months ago”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | command and control server | Explicit | 135 |
| outgoing | ATTRIBUTED_TO | Russia | Attributed | 135 |
| incoming | INVOLVES | Costa Rica ransomware attack | Explicit | 135 |
| incoming | INVOLVES | The D.R. Incident | Explicit | 135 |
Costa Rica ransomware attack INVOLVES Conti
Twenty Costa Rican government organizations were hit with Conti ransomware.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“twenty different government organizations in Costa Rica were hit with this Conti ransomware”
The D.R. Incident INVOLVES Conti
The Dominican Republic campaign included Conti-related command-and-control activity and staged Conti ransomware, although the ransomware was stopped before execution.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
“they seemed to have stopped the Conti ransomware attack before it actually triggered ransomware on any systems”
Conti USES command and control server
A command-and-control server was utilized by Conti to control infected systems.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a C2 server that was utilized by Conti”
Jack says Conti has been widely attributed to Russia.
Attributed Confidence 91% · Jack Rhysider EP 135 Details
“Conti has been widely-attributed to be from Russia”