Severity
High
Analysis Summary
Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted networks and threatens to disseminate it unless the ransom is paid. Conti ransomware enhances performance by utilizing “up to 32 simultaneous encryption operations,” and is very likely directly controlled by its controllers. This ransomware can target network-based resources while ignoring local files. This feature has the noticeable impact of being able to create targeted harm in an environment in a way that might hinder incident response actions.
Impact
- Sensitive File Theft
- File Encryption
Indicators of Compromise
MD5
- 9eb9197cd58f4417a27621c4e1b25a71
SHA-256
- 004ede55a972e10d9a21bcf338b4907d6eed65bf5ad6abbbd5aec7d8484bdedf
SHA-1
- b374eb643b20e47cd9c45811c09e4e73b5871506
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at your respective controls