Conti Group Compromised 40 Firms in Just One Month

Prolific ransomware team Conti managed to breach 40 victim corporations in a fast-hearth marketing campaign about the system of just a number of months, according to new investigation from Group-IB.

The Singapore-centered threat intelligence firm claimed in a new report that the “ARMattack” operation ran from November 17 to December 20 2021.

On the other hand, it was startlingly effective, with victims largely concentrated in the US (37%), but also Europe, India and the UAE.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The group’s quickest attack was carried out in particularly three times, from original obtain to information encryption, accelerated by the simple fact that its associates work 14-hour times with out holiday seasons, according to Team-IB.

Conti ongoing its amazing report into 2022, compromising and leaking information on a further 156 firms in just the 1st four months. By Team-IB’s reckoning, it has stolen facts from at the very least 859 businesses above its two-yr existence, despite the fact that the actual whole of victims is believed to be considerably better.

A huge internal data breach earlier this 12 months disclosed the interior workings of the team for the 1st time. It highlighted a demanding operational structure, which includes alphabetized groups that includes developers, pen testers, OSINT experts, admins and QA and reverse engineer gurus.

The group also employed an HR and recruitment direct, a person in cost of its information leak site, a teaching expert and a blockchain lead.

It is thought it expended at minimum $6m each year on salaries, tools and expert services.

Nonetheless, the group appeared to shut down its operations in May, unplugging its IT infrastructure, which include chat servers. The determination might have been taken thanks to the information leak and/or its selection to publicly back again Russia’s war in Ukraine.

Most likely, team customers will reform and rebrand, as most ransomware outfits do.

“Ransomware is no more time a match between ordinary malware builders, but an illicit RaaS sector that offers work opportunities to countless numbers of cyber-criminals all over the world with numerous specializations,” reported Ivan Pisarev, head of the Dynamic Malware Analysis Staff at Team-IB.

“In this sector, Conti is a notorious participant that has in truth made an ‘IT company’ whose objective is to extort significant sums. The team will proceed its operations, either on its have or with the enable of its ‘subsidiary’ projects.”