Summary

Conti Ransomware has been described as the successor to the popular Ryuk ransomware family. Increasingly, threat actors are now distributing the malware via the same method used to distribute Ryuk in the past.

Capabilities

• Initial Access

  This ransomware may arrive in the system as a result of an infection of BazarLoader which is a result of a phishing email containing a link to Google Drive that downloads the malware.

• Lateral Movement and Defense Evasion

  Attackers also used batch files to disable security tools. It is executed through a scheduled task. After gaining the credentials of the domain administrator, the attackers are now free to move laterally on the network.

• Credential Access

  After gaining information on the domain accounts, attackers then dump the domain controller credentials using ntdsutil.

• Exfiltration

  An attacker uses a tool named RClone tool to perform data exfiltration. This tool is an open-source tool use to sync files to specified cloud storage. In this case, Mega Cloud storage.

• Impact

  After exfiltration and distribution of the ransomware to the targetted endpoints, files are not encrypted. It also inhibits system recovery by deleting shadow copies using WMI.

Infection Routine