ATT&CK ReferencesCybleinc Conti January 2020

Cybleinc Conti January 2020

Cybleinc. (2021, January 21). Conti Ransomware Resurfaces, Targeting Government & Large Organizations. Retrieved April 13, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1486 Data Encrypted for Impact	MalwareConti	Conti can use `CreateIoCompletionPort()`, `PostQueuedCompletionStatus()`, and `GetQueuedCompletionPort()` to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption. CarbonBlack Conti July 2020 CrowdStrike Wizard Spider October 2020 Cybereason Conti Jan 2021 Cybleinc Conti January 2020 DFIR Conti Bazar Nov 2021

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.