Conti Ransomware

August 15, 2021

Topics

Ransomware
Cybersecurity

Conti is one of the more successful ransomware gangs that are currently still operating. According to the FBI, they have over 400 victims and on average demand 25 million USD to have the data that they have stolen decrypted. Unlike other ransomware gangs who avoid attacking critical infrastructure such as hospitals and law enforcement agencies, Conti goes after whoever they can to make money. Conti works similarly to DarkSide and REvil in that it provides Ransomware-as-a-service (RaaS). This means that they create the ransomware as a product and sell it to affiliates who have gained access to networks by purchasing it from other cybercrime groups.

Initial Access

For groups like CONTI, initial access is normally bought from other cybercrime groups that specialize in initial access. These groups use several methods from vast phishing campaigns and malware botnets to leveraging zero-day exploits to get in. Once they have an initial foothold on a network, they turn to the DarkWeb to look for a buyer, this is where Conti’s affiliates come in.

Techniques After Initial Access

Once they’ve gained initial access the first thing that an affiliate seems to do is figure out exactly where in the environment they are. They do this by running several shell commands to check which user they are, which group they are a part of, a list of domain controllers, etc.

After they have figured out who they’ve compromised and what type of permissions they have, the affiliate starts to look around for files that contain sensitive information such as financial documents, accounting documents, client information, or any proprietary information that they can exfiltrate from the machines to be held for ransom.

When the affiliate is done searching for valuable information, they start attempting to move laterally through the network to compromise more machines. This is done using several methods, but the most common method is called Kerberoasting. A Kerberoast is a way for attackers to find credentials so they can gain access to other machines on the network and continue their path to encrypting and

Escalating Privileges

Sometimes the attackers will get onto a machine and only have access as a low-level user. This means they do not have the privileges to modify files and will need to compromise another user profile to take over the machine. The most common technique currently being used by attackers is to use the PrintNightmare exploit to gain system level access to a machine. This works by exploiting a vulnerability in the windows Print Spooler service, which if done correctly could allow attackers to do anything from install, change or delete programs and data to creating new users with administrative rights.

Mitigation Techniques

The best way to stop these attacks is a Defense in Depth approach. Every company should implement a strong password policy as well as Multi-Factor Authentication. Firewalls and Anti-Virus systems should be in place but these days this is not enough. The tactics, techniques, and procedures that ransomware gangs like Conti use can evade most standard detection systems. the only way to mitigate these attacks is to constantly monitor your network for anomalous user behavior. This can be done by using a SIEM to look for Indicators of Compromise (IOCs) and anomalous user behavior. On top of all that most major companies should implement a service that tracks for information leaks on the web. Finding stolen credentials before they get used is just another technique that can be used to stop attackers before they get onto your network.

Conti Ransomware

Initial Access

Techniques After Initial Access

Escalating Privileges

Mitigation Techniques

Up Next

Black Cat Attack on UnitedHealth Group

Chinese Hackers Exploit FortiOS Vulnerability