Blog
/
/
December 7, 2021

Conti Ransomware Strategies in Modern Cybercrime

Uncover the strategies behind the Conti ransomware gang's double extortion methods and what it means for businesses facing cyber threats.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Fier
SVP, Red Team Operations
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
07
Dec 2021

In a previous blog, we outlined how the Ryuk ransomware strain developed by Russian hacking group ‘Wizard Spider’ has fallen into the hands of small-time cyber criminals.

Wizard Spider – who allegedly operate with support from the Russian government and remain under investigation by the FBI and Interpol – adopted Ryuk ransomware’s successor ‘Conti’ in 2020. Conti affects all Windows operating systems and has been involved in more than 400 incidents. Wizard Spider were soon rebranded in cyber press as the ‘Conti Ransomware Gang’, though the group does not necessarily see itself as a ‘gang’. It prefers to present itself as a business.

The ransomware bubble

Ransomware has become a multibillion-dollar industry – and the Conti Ransomware Gang reportedly made up 15% of it in 2020. With this scale of income, groups like Conti find themselves adopting some crude imitations of legitimate business practice. This corporate mimicry dictates that their victims be called ‘customers’, their extortion attempts ‘negotiations’ and their criminal peers ‘affiliates’. They even publish ‘press releases’ via a dedicated Dark Web site.

The gang’s Ransomware-as-a-Service ‘business model’ consists of employing affiliates, training them in Conti ransomware’s deployment and management, and then taking 30% of the profits themselves. With exact profits known only to the malware writers and not the affiliates, however, the percentage Conti takes is often much higher than the 30% they claim.

There may not be checks and regulations in place to address fraud in the cyber underworld, but one business complication which Conti have not been able to escape is that of the disgruntled employee.

Unhappy with the malpractice of their superiors, an underpaid affiliate leaked the Conti Ransomware Gang’s training materials and the IP addresses for their Cobalt Strike C2 servers in August 2021, declaring, “they recruit suckers and divide the money among themselves”.

Meanwhile, the US Government has also been taking action to try to disrupt the profit margins of groups like the Conti Ransomware Gang, going as far as to impose sanctions on cryptocurrency exchanges seen as facilitating ransomware transactions. However, leaks and legislation have proved far from fatal for Conti.

The reality is that these actions have not lost the Conti Ransomware Gang any of its so-called “customers”, and where there are customers there is profit. Any individual or organization entrusting their cyber security to conventional, rules-based measures is in their target market.

Darktrace’s AI recently detected a Conti attack conducted along the lines of one of the methods outlined in the August leak. The target organization – a US transportation company – was trialing Darktrace but, without Darktrace’s Autonomous Response set in active mode, the attack was allowed to go ahead. In examining how it progressed, however, it should become clear not only how threatening double extortion ransomware attacks like this one can be, but also how effectively they can be stopped by Darktrace at each stage of the attack.

Figure 1: Timeline of the attack

Conti Ransomware Gang diversifies the ransomware playbook

A single uninstalled Microsoft patch had left the target organization with dangerous ProxyShell vulnerabilities. Conti exploited these vulnerabilities, quickly gaining the rights to remotely execute Exchange PowerShell commands on the company’s server and steadily broadened its presence within the digital environment. This is a relatively new approach for the Conti Ransomware Gang, who previously relied upon phishing attacks and firewall exploits. By diversifying its approach, it stays ahead of patches and intelligence.

Two weeks after the initial breach, C2 connections were made to an unusual endpoint located in Finland using an SSL client which appeared innocuous but was 100% rare for the organization. Had Autonomous Response been set in active mode, Darktrace would have shut the connections down at this very early stage.

The IP address of this suspicious endpoint has since been identified as a Conti IoC (Indicator of Compromise), allowing it to be incorporated into rules-based security solutions. This would have done little good for the company in question, however, which was breached weeks before this intelligence was made available.

As Conti continued to conduct internal reconnaissance and move laterally through the company’s digital environment, Darktrace detected further unusual activity. The suspicious Finnish endpoint then employed new ‘Living off the Land’ techniques, installing the usually legitimate tools AnyDesk and Cobalt Strike onto various parts of the environment.

A series of SSL connections were made to AnyDesk endpoints and external hosts, one of which lasted 95 hours, indicating an active remote session conducted by one of Conti’s affiliates. At this stage, Darktrace had 10 distinct reasons to suspect an imminent attack.

Conti News: Closing the deal with double extortion ransomware

Double extortion has become the Conti Ransomware Gang’s new favourite sales tactic. If you refuse to pay its ransom, Conti will not only take your most important files from you, but also exfiltrate and publish them using its dedicated ‘Conti News’ website, or sell them directly to your competitors.

Having expanded their reach across the transport company’s network, the Conti affiliate began rapidly exfiltrating large quantities of company data to Conti’s preferred cloud storage site, MEGA. Over four days, more than 3TB of data was uploaded, and then encrypted.

To avoid detection by a human security team, encryption was launched at close to midnight – Conti’s ‘business’ does not respect business hours. When the company’s security team returned to work the next day, they were met with a ransom note.

This attack was able to progress because Darktrace was only being trialed at this stage and was therefore allowed to detect threats but not to take action against them. With Autonomous Response employed in active mode, this ransomware attack would have ended in the very early stages, when Darktrace detected its first suspicious connections.

Nonetheless, the Cyber AI Analyst was able to investigate and connect the dots of the attack automatically, making the organization’s remediation efforts drastically quicker and easier than they would have been without even this partial Darktrace deployment.

Figure 2: Cyber AI Analyst generated this incident report following the initiation of data exfiltration

How the Conti Ransomware Gang evades cyber intelligence

Security systems that rely on human intelligence to detect threats fit Conti’s ideal customer profile perfectly. By adapting and diversifying their approach, moving from Ryuk to Conti, and from spear phishing and firewall exploits to this new ProxyShell approach, Conti stay ahead of regulations and hold on to their vulnerable customer base.

Even if the Conti Ransomware Gang is brought down by leaks or legislation, other groups will rise to fill the gap in the market, eager for their own cut of the illicit gains. If these groups are to be truly stopped, they must be made unprofitable.

The US government has tried to do this by imposing fines upon ransom payers, but companies still often consider the losses involved in not recovering their data too great. As I have argued previously, ‘to pay or not to pay,’ is not the question we should be asking.

If you’re deciding whether to pay or not to pay, you’re already too far down the line. Darktrace stops groups like Conti at the first encounter. As this case has shown, Darktrace’s Self-Learning AI is able to identify threats weeks before human analysts and threat intelligence can do the same, and neutralize them at every stage of an attack with Autonomous Response.

Thanks to Darktrace analyst Sam Lister for his insights on the above threat find.

Darktrace model detections:

  • Device / Long Agent Connection to New Endpoint
  • Device / ICMP Address Scan
  • Anomalous Connection / SMB Enumeration
  • Anomalous Server Activity / Outgoing from Server
  • Compromise / Beacon to Young Endpoint
  • Anomalous Server Activity / Rare External from Server
  • Compromise / Fast Beaconing to DGA
  • Compromise / SSL or HTTP Beacon
  • Compromise / Sustained SSL or HTTP Increase
  • Compromise / Beacon for 4 Days
  • Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
  • Unusual Activity / Enhanced Unusual External Data Transfer
  • Anomalous Connection / Data Sent to Rare Domain
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Compliance / SMB Drive Write
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Anomalous Connection / Suspicious Read Write Ratio
  • Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
  • Anomalous Connection / Sustained MIME Type Conversion
  • Unusual Activity / Anomalous SMB Move & Write
  • Unusual Activity / Unusual Internal Data Volume as Client or Server
  • Device / Suspicious File Writes to Multiple Hidden SMB Shares
  • Compromise / Ransomware / Suspicious SMB Activity
  • Anomalous File / Internal / Unusual SMB Script Write
  • Anomalous File / Internal / Masqueraded Executable SMB Write
  • Device / SMB Lateral Movement
  • Device / Multiple Lateral Movement Model Breaches

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Justin Fier
SVP, Red Team Operations

More in this series

No items found.

Blog

/

/

September 23, 2025

It’s Time to Rethink Cloud Investigations

cloud investigationsDefault blog imageDefault blog image

Cloud Breaches Are Surging

Cloud adoption has revolutionized how businesses operate, offering speed, scalability, and flexibility. But for security teams, this transformation has introduced a new set of challenges, especially when it comes to incident response (IR) and forensic investigations.

Cloud-related breaches are skyrocketing – 82% of breaches now involve cloud-stored data (IBM Cost of a Data Breach, 2023). Yet incidents often go unnoticed for days: according to a 2025 report by Cybersecurity Insiders, of the 65% of organizations experienced a cloud-related incident in the past year, only 9% detected it within the first hour, and 62% took more than 24 hours to remediate it (Cybersecurity Insiders, Cloud Security Report 2025).

Despite the shift to cloud, many investigation practices remain rooted in legacy on-prem approaches. According to a recent report, 65% of organizations spend approximately 3-5 days longer when investigating an incident in the cloud vs. on premises.

Cloud investigations must evolve, or risk falling behind attackers who are already exploiting the cloud’s speed and complexity.

4 Reasons Cloud Investigations Are Broken

The cloud’s dynamic nature – with its ephemeral workloads and distributed architecture – has outpaced traditional incident response methods. What worked in static, on-prem environments simply doesn’t translate.

Here’s why:

  1. Ephemeral workloads
    Containers and serverless functions can spin up and vanish in minutes. Attackers know this as well – they’re exploiting short-lived assets for “hit-and-run” attacks, leaving almost no forensic footprint. If you’re relying on scheduled scans or manual evidence collection, you’re already too late.
  2. Fragmented tooling
    Each cloud provider has its own logs, APIs, and investigation workflows. In addition, not all logs are enabled by default, cloud providers typically limit the scope of their logs (both in terms of what data they collect and how long they retain it), and some logs are only available through undocumented APIs. This creates siloed views of attacker activity, making it difficult to piece together a coherent timeline. Now layer in SaaS apps, Kubernetes clusters, and shadow IT — suddenly you’re stitching together 20+ tools just to find out what happened. Analysts call it the ‘swivel-chair Olympics,’ and it’s burning hours they don’t have.
  3. SOC overload
    Analysts spend the bulk of their time manually gathering evidence and correlating logs rather than responding to threats. This slows down investigations and increases burnout. SOC teams are drowning in noise; they receive thousands of alerts a day, the majority of which never get touched. False positives eat hundreds of hours a month, and consequently burnout is rife.  
  4. Cost of delay
    The longer an investigation takes, the higher its cost. Breaches contained in under 200 days save an average of over $1M compared to those that linger (IBM Cost of a Data Breach 2025).

These challenges create a dangerous gap for threat actors to exploit. By the time evidence is collected, attackers may have already accessed or exfiltrated data, or entrenched themselves deeper into your environment.

What’s Needed: A New Approach to Cloud Investigations

It’s time to ditch the manual, reactive grind and embrace investigations that are automated, proactive, and built for the world you actually defend. Here’s what the next generation of cloud forensics must deliver:

  • Automated evidence acquisition
    Capture forensic-level data the moment a threat is detected and before assets disappear.
  • Unified multi-cloud visibility
    Stitch together logs, timelines, and context across AWS, Azure, GCP, and hybrid environments into a single unified view of the investigation.
  • Accelerated investigation workflows
    Reduce time-to-insight from hours or days to minutes with automated analysis of forensic data, enabling faster containment and recovery.
  • Empowered SOC teams
    Fully contextualised data and collaboration workflows between teams in the SOC ensure seamless handover, freeing up analysts from manual collection tasks so they can focus on what matters: analysis and response.

Attackers are already leveraging the cloud’s agility. Defenders must do the same — adopting solutions that match the speed and scale of modern infrastructure.

Cloud Changed Everything. It’s Time to Change Investigations.  

The cloud fundamentally reshaped how businesses operate. It’s time for security teams to rethink how they investigate threats.

Forensics can no longer be slow, manual, and reactive. It must be instant, automated, and cloud-first — designed to meet the demands of ephemeral infrastructure and multi-cloud complexity.

The future of incident response isn’t just faster. It’s smarter, more scalable, and built for the environments we defend today, not those of ten years ago.  

On October 9th, Darktrace is revealing the next big thing in cloud security. Don’t miss it – sign up for the webinar.

darktrace live event launch
Continue reading
About the author
Kellie Regan
Director, Product Marketing - Cloud Security

Blog

/

/

September 22, 2025

Understanding the Canadian Critical Cyber Systems Protection Act

Canadian critical cyber systems protection actDefault blog imageDefault blog image

Introduction: The Canadian Critical Cyber Systems Protection Act

On 18 June 2025, the Canadian federal Government introduced Bill C-8 which, if adopted following completion of the legislative process, will enact the Critical Cyber Systems Protection Act (CCSPA) and give Canada its first federal, cross-sector and legally binding cybersecurity regime for designated critical infrastructure providers. As of August 2025, the Bill has completed first reading and stands at second reading in the Canadian House of Commons.

Political context

The measure revives most of the stalled 2022 Bill C-26 “An Act Respecting Cyber Security” which “died on Paper” when Parliament was prorogued in January 2025, in the wake of former Prime Minister Justin Trudeau’s resignation.

The new government, led by Mark Carney since March 2025, has re-tabled the package with the same two-part structure: (1) amendments to the Telecommunications Act that enable security directions to telecoms; and (2) a new CCSPA setting out mandatory cybersecurity duties for designated operators. This blog focuses on the latter.

If enacted, Canada will join fellow Five Eyes partners such as the United Kingdom and Australia, which already impose statutory cyber-security duties on operators of critical national infrastructure.

The case for new cybersecurity legislation in Canada

The Canadian cyber threat landscape has expanded. The country's national cyber authority, the Canadian Centre for Cybersecurity (Cyber Centre), recently assessed that the number of cyber incidents has “sharply increased” in the last two years, as has the severity of those incidents, with essential services providers among the targets. Likewise, in its 2025-2026 National Cyber Threat Assessment, the Cyber Centre warned that AI technologies are “amplifying cyberspace threats” by lowering barriers to entry, improving the speed and sophistication of social-engineering attacks and enabling more precise operations.

This context mirrors what we are seeing globally: adversaries, including state actors, are taking advantage of the availability and sophistication of AI tools, which they have leverage to amplify the effectiveness of their operations. In this increasingly complex landscape, regulation must keep pace and evolve in step with the risk.

What the Canadian Critical Cyber Systems Protection Act aims to achieve

  • If enacted, the CCSPA will apply to operators in federally regulated critical infrastructure sectors which are vital to national security and public safety, as further defined in “Scope” below (the “Regulated Entities”), to adopt and comply with a minimum standard of cybersecurity duties (further described below)  which align with those its Five Eyes counterparts are already adhering to.

Who does the CCSPA apply to

The CCSPA would apply to designated operators that deliver services or systems within federal jurisdiction in the following priority areas:

  • telecommunications services
  • interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems
  • banking and clearing  
  • settlement systems

The CCSPA would also grant the Governor in Council (Federal Cabinet) with powers to add or remove entities in scope via regulation.

Scope of the CCSPA

The CCSPA introduces two key instruments:

First, it strengthens cyber threat information sharing between responsible ministers, sector regulators, and the Communications Security Establishment (through the Cyber Centre).

Second, it empowers the Governor in Council (GIC) to issue Cyber Security Directions (CSDs) - binding orders requiring a designated operator to implement specified measures to protect a critical cyber system within defined timeframes.

CSDs may be tailored to an individual operator or applied to a class of operators and can address technology, process, or supplier risks. To safeguard security and commercial confidentiality, the CCSPA restricts disclosure of the existence or content of a CSD except as necessary to carry it out.

Locating decision-making with the GIC ensures that CSDs are made with a cross-government view that weighs national security, economic priorities and international agreement.

New obligations for designated providers

The CCSPA would impose key cybersecurity compliance and obligations on designated providers. As it stands, this includes:

  1. Establishing and maintaining cybersecurity programs: these will need to be comprehensive, proportionate and developed proactively. Once implemented, they will need to be continuously reviewed
  2. Mitigating supply chain risks: Regulated Entities will be required to assess their third-party products and services by conducting a supply chain analysis, and take active steps to mitigate any identified risks
  3. Reporting incidents:  Regulated Entities will need to be more transparent with their reporting, by making the Communications Security Establishment (CSE) aware of any incident which has, or could potentially have, an impact on a critical system. The reports must be made within specific timelines, but in any event within no more than 72 hours;
  4. Compliance with cybersecurity directions:  the government will, under the CCSPA, have the authority to issue cybersecurity directives in an effort to remain responsive to emerging threats, which Regulated Entities will be required to follow once issued
  5. Record keeping: this shouldn’t be a surprise to many of those Regulated Entities which fall in scope, which are already likely to be subject to record keeping requirements. Regulated Entities should expect to be maintaining records and conducting audits of their systems and processes against the requirements of the CCSPA

It should be noted, however, that this may be subject to change, so Regulated Entities should keep an eye on the progress of the Bill as it makes its way through parliament.

Enforcement of the Act would be carried out by sector-specific regulators identified in the Act such as the Office of the Superintendent of Financial Institutions, Minister of Transport, Canada Energy Regulator, Canadian Nuclear Safety Commission and the Ministry of Industry.

What are the penalties for CCSPA non-compliance?

When assessing the penalties associated with non-compliance with the requirements of the CCSPA, it is clear that such non-compliance will be taken seriously, and the severity of the penalties follows the trend of those applied by the European Union to key pieces of EU legislation. The “administrative monetary penalties” (AMPs) set by regulation could see fines being applied of up to C$1 million for individuals and up to C$15 million for organizations.

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI