Conti ransomware case study

One of the most prolific ransomware variants to hit is Conti. There are two aspects to Conti that make it stand out in terms of threat actors. The first of these aspects is that Conti is a RaaS threat actor. This type of threat actor uses an affiliate model where highly skilled recruits are found on hacking forums. From there, they are provided the tools and techniques necessary to execute the initial stage: attack and deploy ransomware. The original coders of the Conti variant are then provided a fee of anywhere between 10 to 30 percent of the ransom.

The second of these is that Conti affiliates will often exfiltrate data, along with encrypting files. This data is then held “hostage” by the affiliate for ransom. If the victim organization did not pay in time, the data would be released. Conti affiliates were even able to use a website both on the internet and on the dark web to post the data.

Before being shut down, the Conti variant...