Conti ransomware is rapidly spreading
Although you may not be familiar with the name, a strain of ransomware called "Conti" is surging in popularity on the Dark Web and seeing a rapidly growing number of installations, so it's definitely one to be on guard against.
Advanced-Intel's Vitali Kremez has been tracking this strain since it first appeared in late 2019.
According to Kremez, the code appears to be an offshoot of an older strain of ransomware called Ryuk. The number of active installs of Ryuk has been declining for a few years now, while the number of Conti installations increases at virtually the same pace.
Kremez had this to say about the new threat
"Based on multiple incident response matters and current assessment, it is believed that Conti ransomware is linked to the same Ryuk ransomware developer group based on the code reuse and unique TrickBot distribution. The same distribution attack vector is used widely by the Ryuk deployment group."
While there are a number of interesting aspects to the design of Conti, one of the most interesting is the fact that it utilizes 32 threads during the file encryption process. While multi-threaded ransomware isn't new or unique, Conti is the first to use 32 threads, which makes it stand out and allows it to encrypt a machine with blinding speed.
The advantage to the attacker here is that the attack might be over before a victim even realizes what's going on. On the other hand, though, a wary, observant user might notice that their computer's performance takes a sudden nosedive, which is a red flag that something is wrong. That gives IT professionals a small window to deploy countermeasures and potentially stave off the attack.
The other interesting aspect of this code's design is the fact that it utilizes the Windows restart manager API to close open files. Again, while not unique, it is something not used by many malware strains, which sets Conti apart.
Our perspective
In any case, it's a serious and growing threat, and one of your staff should be briefed on and prepared for.
~ As Hill Street Blues' Sgt. Esterhaus always advised: "Hey, let's be careful out there! " ~
By Denis Wilson and Melissa Stockwell
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. I am also available on LinkedIn, Facebook, and Twitter.
I'm Denis Wilson, President and Principal Consultant for DWP Information Architects. We build people / process / technology solutions to create better business outcomes for smaller enterprises in Los Angeles. We have created cost-effective office productivity and out-sourced service solutions for over 20 years, focusing principally on manufacturing and healthcare. Our hallmarks are reliability, cybersecurity, and regulatory compliance.
I am also a published author and speaker, working extensively with business and professional associations to provide small business technology education programs.
Contact me if you would like me to speak at your association
