Conti

The U.S. and German government’s action today addresses the abuse of virtual currency to launder ransom payments.

All of these networks use search engine optimization to put a “bait” webpage on the first page of results for search engine queries seeking “crack” versions of a variety of software products.

GTsSS cyber actors frequently collect credentials to gain initial access to target organizations... Russian state-sponsored APT actors have demonstrated their ability to maintain persistence using compromised credentials.

The sort of “watering hole” attack we saw here uses carefully cultivated search engine optimization to draw in a specific kind of victim: computer users seeking pirated software.

Both Conti and another criminal crew called Karma hit the unidentified org through the ProxyShell exploit...

...the WizardSpider criminal crew used the Conti ransomware to lock up the whole of Ireland's state-run health service... after a phishing email hit its mark...

"The Malware infection was the result of the user of the Patient Zero Workstation clicking and opening a malicious Microsoft Excel file that was attached to a phishing email sent to the user on 16 March 2021."

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

The download was a .zip archive file named after the alleged “cracked” product sought by the target.

Completing the download resulted in the delivery of a malware payload.

GTsSS cyber actors frequently collect credentials to gain initial access to target organizations... Russian state-sponsored APT actors have demonstrated their ability to maintain persistence using compromised credentials.

GTsSS cyber actors frequently collect credentials to gain initial access to target organizations... Russian state-sponsored APT actors have demonstrated their ability to maintain persistence using compromised credentials.

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

GTsSS cyber actors frequently collect credentials to gain initial access to target organizations... Russian state-sponsored APT actors have demonstrated their ability to maintain persistence using compromised credentials.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

RDP exploitation is one of the top initial infection vectors for ransomware... notable initial access and persistence vectors for affiliated actors include Emotet, Cobalt Strike, spearphishing, and stolen or weak Remote Desktop Protocol (RDP) credentials.

By covering as much ground as possible, attackers can harvest and leak data to their C2 (Command and Control Infrastructure) before deploying ransomware payloads on the network.

The infrastructure commonly supports ransomware command and control (C2) servers, malware distribution, phishing campaigns, botnet management, and data exfiltration staging.

By covering as much ground as possible, attackers can harvest and leak data to their C2 (Command and Control Infrastructure) before deploying ransomware payloads on the network.

the perpetrators allegedly stole “non-critical” employee data... Conti... stated it stole approximately 14 GB (13.88 GB) worth of files.

When the ransom demand was not met, he allegedly encouraged co-conspirators to leak or sell the data.

the threat actors exfiltrated approximately 90 GB of data to various cloud storage providers including filetransfer.io, filemail.net, sendspace.com, and dropbox.com.

According to the investigation, he developed malware in January of this year to obtain illegal profits. The accused intended to use it to encrypt commercial organizations' data and demand a ransom for decryption, Russian prosecutors said.

Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.

The ransomware attack has prevented the government from effectively collecting taxes, and some public employees’ salaries are either being overpaid or underpaid, Chaves said.

He analyzed stolen data and used sensitive information to intensify extortion tactics. When the ransom demand was not met, he allegedly encouraged co-conspirators to leak or sell the data. Court documents reveal he distributed a bulk set of sensitive records to hundreds of patients, aiming to amplify fear and force compliance.

Conti also dropped a batch script onto the target network to disable Windows Defender, shortly before deploying their full payload.