A joint cybersecurity advisory from CISA, FBI, NSA, and the U.S. Secret Service documents over 1,000 Conti ransomware attacks against U.S. and international organizations, providing detailed technical insight into one of the most prolific and damaging ransomware operations of its era. Unlike typical ransomware-as-a-service models where affiliates receive a percentage of ransom proceeds, Conti's structure is assessed to pay deployers a wage — a distinction that gives the core group tighter operational control and reduces the risk of affiliate defection or operational security failures.
Initial Access: Multiple Vectors, Maximum Coverage
Conti actors gain initial access through a diverse set of entry points, making perimeter defense particularly challenging. Observed vectors include spear-phishing emails with malicious Word attachments (which execute embedded scripts to download TrickBot, IcedID, or Cobalt Strike), stolen or weak RDP credentials, phone-based social engineering, fake software promoted via SEO poisoning, distribution through other malware networks such as ZLoader, and exploitation of common vulnerabilities in external-facing assets.
Execution, Persistence, and Lateral Movement
During execution, Conti actors first run a low-risk getuid payload to probe the environment before deploying more aggressive capabilities — a deliberate technique to reduce the probability of triggering antivirus detection during initial staging. The advisory documents use of Router Scan, a penetration testing tool, to brute-force routers, cameras, and NAS devices with web interfaces, as well as Kerberos attacks to obtain admin hashes for further brute-force operations.
For persistence and lateral movement, Conti actors exploit legitimate remote monitoring and management software as backdoors, augment living-off-the-land techniques with Windows Sysinternals and Mimikatz for credential harvesting and privilege escalation, and exploit high-impact vulnerabilities including the 2017 SMBv1 vulnerabilities, PrintNightmare (CVE-2021-34527), and Zerologon (CVE-2020-1472). TrickBot is used for post-exploitation tasks alongside Cobalt Strike, with four specific Cobalt Strike C2 IPs identified from leaked actor playbooks: 162.244.80[.]235, 85.93.88[.]165, 185.141.63[.]120, and 82.118.21[.]1.
Double Extortion and Data Exfiltration
Conti employs double extortion as standard operating procedure: after stealing and encrypting victim data, actors demand ransom for the decryption key while simultaneously threatening to publicly release the stolen data if payment is refused. Data exfiltration is conducted using Rclone, an open-source command-line program, providing cloud-storage-based staging that blends with legitimate network traffic and avoids direct attacker-controlled infrastructure during the exfiltration phase.
Recommended Mitigations
CISA, FBI, NSA, and the USSS prioritize the following defensive measures: enforcing multi-factor authentication across all remote access including VPN and RDP; implementing network segmentation to limit lateral movement blast radius; maintaining up-to-date patches with priority on internet-facing systems; monitoring for anomalous use of legitimate tools such as Rclone, Cobalt Strike, and Windows Sysinternals; and auditing privileged account access patterns to detect pass-the-hash and Kerberoasting activity.