# Analysis of Leaked Conti Intrusion Procedures by eSentire’s Threat Response Unit (TRU)

**[esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru](https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru)**

As defenders, often our only insight into an adversary’s tradecraft is gleaned through an
analysis of intrusion artifacts following an incident. The recent leak of Conti and Trickbot
materials offers a glimpse into how the group infiltrated and took control of networks in
extortion attacks. While the leaked manual and forum are from early to mid-2021, they offer a
snapshot of how the group trained and conducted their intrusions. The Conti team likely
maintains similar, up-to-date manuals, and knowledge base articles.

## Key Takeaways:

There is a heavy reliance on Offensive Security Tooling (OST) such as Cobalt Strike,
Mimikatz, Powerview, and known attack techniques throughout the intrusion phases.
Dual-use tools such as 7zip, AnyDesk, Rclone, and living-off-the-land Windows utilities
have been used to reduce exposure.
Tooling is augmented with using scripts to facilitate deployment and use. For example,
Cobalt Strike is augmented with using known resources like C2Concealer and scripts
compiled from public research.


-----

_Figure 1 Forum post recommending various penetration testing utilities._

## Background

[On February 27, 2022, a Twitter account named “ContiLeaks” began posting chat logs](https://twitter.com/ContiLeaks)
showing private communications between Conti members. These logs spanned between
January 2021 and February 2022 and contained thousands of messages between alleged
Conti members. Following this, the ContiLeaks account published additional chat logs from
June 2020 to November 2020, an extract of a trickconti-forum, Rocketchat logs, and Trickbot
and Conti software components among other materials.

[Our Threat Response Unit (TRU), Journalists and](https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/) [researchers have dug through the chat](https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/)
logs and identified key players and organizational structure. The group operates like a
structured organization, with team leaders and departments responsible for hiring talent,
research & development, training, and conducting “penetration tests”.

Besides the chat logs, our attention was drawn to intrusion procedures in the form of
manuals and knowledge base articles. Like a legitimate organization, Conti maintains
reference material for ensuring work is done consistently and up to standards.

_Figure 2 Excerpt from leaked Rocketchat logs making a case for a centralized knowledge_
_base._

Two sources for intrusion procedures have been identified thus far:

**"manual_teams_c"**

Taken from leaked Rocketchat logs from May 2021, helpfully extracted and published
by [Émilio Gonzalez.](https://github.com/Res260/conti_202202_leak_procedures)


-----

Analysis of the files extracted from the Rocketchat logs showed overlap with the leaked
Conti Playbook from August 2021

**“trickconti-forum”**

Posted by Twitter user ContiLeak on March 1st, 2022 without context.
Forum containing 51 text files of how-to guides for attack procedures and intrusion
methods, organized into kill chain phases.
User “Rozetka”, who is identified as a team lead in the leaked Rocketchat logs, is
mentioned heavily throughout the forum posts.
Most posts were dated February-March 2021.

_Figure 3 August 2020 Rocketchat discussion about team composition and responsibilities._

Additionally, the forum is mentioned several times in leaked Rocketchat logs.


-----

_Figure 4 Rocketchat discussion for_

_"trickconti" forum._

## Breakdown by Intrusion Phase

### Reconnaissance

During Reconnaissance, threat actors rely on the passive collection of information related to
their target’s internal environment using public domain and reputational databases. This is
[achieved using open-source tooling such as Sub-Drill and penst-tools[.]com.](https://github.com/Fadavvi/Sub-Drill)

[For active scanning, the Aquatone tool is used to visually inspect websites and servers for](https://github.com/michenriksen/aquatone)
attack opportunities.

### Initial Access

To gain initial access, the Conti group leverages techniques that include remote access
services and compromised endpoints. The trickconti forum mentions various remote access
services from Citrix, SonicWall, FortiGate and Pulse Secure.

To circumvent multi-factor authentication on VPNs, operators will attempt to intercept MFA
codes from compromised email accounts or hijack browser sessions using tokens stolen
from compromised endpoints.


-----

_Figure 5 Post from February 2021 discussing browser session hijacking._

### Discovery

Once operators land on a compromised machine or access the network through VPN, their
first step is to gain situational awareness using tools such as AdFind or Windows command
line utilities such as net or nltest. AdFind is referenced heavily throughout leaked procedure
documentation and would appear to be the preferred tool as of early 2021. As is a theme
with other techniques, the tool is augmented through scripts to expedite data collection.

_Figure 6 Sample output from AdFind tool._

Collected information includes active directory users, computers, Organizational Units (OUs),
domain trusts and subnets. The data is written to text files and used in downstream attacks
or information gathering.

The Invoke-ShareFinder module from PowerView is also mentioned as a means to
enumerate network shares.

### Credential Access and Privilege Escalation

The next step is to steal credentials and escalate their privileges to gain higher-level
permissions into the system or network. Multiple known techniques are mentioned to fulfill
this objective:

[Kerberoasting](https://attack.mitre.org/techniques/T1558/003/)


-----

[AS-REP Roasting](https://attack.mitre.org/techniques/T1558/004/)
[DCSYNC](https://attack.mitre.org/techniques/T1003/006/)
[Group Policy Preferences](https://attack.mitre.org/techniques/T1552/006/)
[Password Spray via SMB Bruteforce tool](https://www.shellntel.com/blog/2016/7/7/smart-smb-brute-forcing)
[PowerUpSQL](https://github.com/NetSPI/PowerUpSQL)
Netlogon (CVE-2020-1472)

Kerberoast and AS-REP roast attacks are a known techniques for abusing weaknesses in
Kerberos tickets to extract hashes for offline cracking. The Kerberos attacks are executed
[using either the Rubeus tool or](https://github.com/GhostPack/Rubeus) [Invoke-Kerberoast PowerShell module. Kerberoasting is](https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/)
mentioned several times in the procedure documents and is an early intrusion step
conducted through a VPN session using a compromised account or through a compromised
workstation using Cobalt Strike. Cracked keys can then facilitate privilege escalation
activities.

_Figure 7 Instructions for executing a Kerberoast and AS-REP Roast attack using the Rubeus_
_tool._

### Persistence & Command and Control

Once the threat actors have successfully escalated their privileges, the next priority is to
maintain their foothold into the environment and controlling compromised systems to look
normal and avoid detection. The trickconti forum contains instructions for establishing
persistence through a mix of backdoor malware, webshells and remote access software. The
most common tools mentioned in the guide include:

**[Anchor Backdoor: A sophisticated backdoor believed to be developed by the Trickbot](https://services.global.ntt/en-us/insights/blog/trickbot-variant-communicating-over-dns)**
authors that uses the DNS protocol for communication and is delivered through
Trickbot installations. Anchor is believed to be developed by the Trickbot authors.
**[Ngrok: A utility commonly abused to tunnel traffic between internal hosts and](https://attack.mitre.org/software/S0508/)**
attackers. The guide provides instructions for registering an account on
[http://ngrok.com and a script to automate deployment. The script (Install_ngrok.ps1)](http://ngrok.com/)
automates downloading both Ngrok and Non-Sucking Service Manager (NSSM) to the
target machine, installs Ngrok as a service and configures it to listen on port 3389
(RDP). The utility is subsequently used to tunnel remote desktop traffic to the host from
outside the network/firewall boundary.


-----

**TOR Backdoor: This is used in a similar fashion to Ngrok. Using a PowerShell script**
[(BackdoorNew), a TOR (The Onion Router) client and OpenSSH are downloaded to](https://www.virustotal.com/gui/file/ee97ab55c7f1f2954cf366f9880b5a5f93012272a4b1a904d182bc10c69dc940/content)
the system and installed as services using NSSM. This configuration is presumably
used to create an outbound connection over TOR from which the operator can tunnel
into the host.
**Exchange Webshell: The trickconti forum contains a detailed guide on deploying**
Exchange webshells for persistence. Their steps to plant a webshell in Exchange are
as follows:

1. Connect to the Exchange server.
2. Identify public facing directories such as C$\Program Files\Microsoft\Exchange

_Server\V14\ClientAccess\owa\auth and test access from the outside._
3. Modify the webshell’s timestamp to match surrounding files.
4. Retest the webshell connection from the outside.
The guide was posted February 5, 2021 and predates the disclosure of ProxyLogon
Exchange vulnerabilities in March 2021. It does not indicate Exchange exploits were
used and instead relied on stolen credentials to connect to Exchange servers and
deploy webshells. It’s likely this guide was updated at a later point to incorporate the
[ProxyLogon exploit. A copy of the webshell can be found here.](https://www.virustotal.com/gui/file/0c2c22d67f7e3cc26046e946cf3d48a94ce6936a9ac92d4e8ef1285011b15924?nocache=1)
**Remote Access Software (AnyDesk): AnyDesk Remote access software is among a**
[known list of remote access software abused by Conti operators to remotely access](https://michaelkoczwara.medium.com/conti-ransomware-group-cobalt-strike-c2-analysis-rdp-persistence-cc535d35eaba)
compromised systems. The trickconti forum contains instructions for deploying
AnyDesk to systems using a script:

_Figure 8 Snippet of AnyDesk installation script._
**IIS Patch Backdoor: This is mentioned, but not elaborated on.**

### Targeting Administrators


-----

This is a critical step, as not only do administrator accounts provide access to more sensitive
systems, but their workstations also contain a wealth of information about the organization’s
IT infrastructure. This guide appears identical to what was included in the leaked Conti
playbook in August 2021.

The trickconti forum contains a page aptly called “Hunt Administrator” which describes in
detail how to identify and rank administrative network users.

_Figure 9 Snippet of forum post titled "Hunt Administrator"_

Information about administrators is obtained using output from the AdFind tool (executed as
part of initial network discovery) or using Windows utilities through a Cobalt Strike session.
Example commands include:

net group “domain admins” /domain
net user potential_admin /domain

This data is then manually inspected and validated. Operators are instructed to look for
indicators such as group membership, department or job title. Results are validated by
checking the account status/last logon time and LinkedIn if needed.

_Figure 10 Guidance on validating active administrator accounts._


-----

_Figure 11 Sample_

_output from net command included in the post for demonstration purposes._

[Once administrator accounts are identified, PowerSploit’s Find-DomainUserLocation is used](https://powersploit.readthedocs.io/en/latest/Recon/Find-DomainUserLocation/)
to identify systems where the account is logged in. The guide instructs operators to remotely
extract files from admin workstations using impersonation tokens and either the net Windows
utility or Cobalt Strike’s file browser. It clearly warns the operator against deploying a Cobalt
Strike beacon directly to the system to avoid raising alarms.

Standard user directories such as OneDrive or Documents are reviewed for files of interest
such as password lists. Application folders (AppData\Local and AppData\Roaming) are
checked for custom configurations. Browser history and login data from Chrome, Edge and
Firefox are extracted for useful information such as the location of backup and virtualization
servers. Local Outlook data files are extracted for further analysis.

### Exfiltration

The next step is to exfiltrate the data from the organization’s network by packaging it using
compression and encryption to avoid detection. In addition to using the TOR backdoor tool,
the guide mentioned two other tools:


-----

**FileZilla: Used by deploying a portable version to compromised hosts and exfiltrating**
data over SFTP (port 22). Additionally, FileZilla can be used to connect to the
compromised host through an established TOR tunnel.
**Rclone: A command line utility for backing up data to cloud services. Unfortunately, the**
tool has been co-opted by ransomware groups such as Conti for exfiltrating data to
services such as Mega[.]nz. The trickconti forum contains a procedure document for
configuring the utility and using it to exfiltrate data from compromised systems. These
instructions mirror closely what was revealed in the Conti Playbook leak from 2021.

_Figure 12 Rclone instructions._

### Inhibit Recovery

Destroying or encrypting backups is typically a late-stage action performed prior-to or during
the encryption stage. Doing so inhibits recovery options for the victim organization, giving
Conti the upper hand in negotiations. Backups can also be targeted for data theft. The
trickconti forum mentions various backup solutions including:

Synology Active Backup for Business
StorageCraft ShadowProtect SPX
Veeam

In general, operators are instructed to identify backup software from browsing history,
running processes, authentication logs, etc. Stolen credentials lists, such as hashes taken
from NTDS, and account lists are checked for possible backup service accounts containing
common string identifiers for a given backup solution. Once obtained, credentials for backup
accounts are used to access and modify backups to inhibit recovery. For more information,
see [https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love.](https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love)

_Figure_

_13 Guidance on picking out account tied to backup services_


-----

The forum also contained a post on recovering passwords from Veeam backup servers.

_Figure 14 Veeam password recovery steps._

[This is a known technique documented as early as 2019 in Veeam’s forums and explained in](https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html)
detail [here. It’s likely this step is taken to obtain credentials not tied to active directory, such](https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/)
[as other backups or infrastructure. A 2020 post on Veeam’s forums by a victim of](https://forums.veeam.com/veeam-backup-replication-f2/saved-passwords-in-veeam-vulnerable-t64964.html)
ransomware describes a similar scenario where non-AD credentials stored in Veeam were
used to access secondary backup storage devices. Advice is given to operators to disable
notifications on backup servers to avoid detection:

_Figure 15 Disabling notifications on backup servers._

Finally, the trickconti forum contains instructions for targeting virtualized infrastructure from
VMware and Microsoft. Once administrative access is achieved to virtualization platforms,
snapshots and backups are destroyed and servers are locked.

In a May 2021 post, a user describes the process for accessing vSphere and identifying
backups for virtual machines by examining the license level and authentication logs from
backup services:


-----

_Figure 16 vSphere instructions._

Figure 17 Additional guidance on encrypting backups tied to virtual machines.

_Figure 18 Hyper-V Instructions._

## How eSentire is Responding


-----

Our Threat Response Unit combines intelligence gleaned from research, security incidents,
and the external threat landscape to create actionable outcomes for our customers. We are
taking a holistic response approach to combat modern ransomware by deploying
countermeasures across the ransomware attack cycle using:

Known-precursor malware
Living-off-the-Land techniques
Discovery techniques and domain reconnaissance (listing admins, domain trusts, etc.)
Offensive security tools such as Cobalt Strike
Credential access techniques (kerberoasting, ZeroLogon, Mimikatz)
Late-stage TTPs (Credential extraction from DCs, PsExec/WMIC/BITS Admin code
deployment)
Final stages (Volume Shadow Copy deletion, ransomware artifacts, archiving tools,
data staging)

Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts
respond rapidly to any intrusion attempt tied to known ransomware tactics, techniques, and
procedures. In addition, our Threat Response Unit closely monitors the ransomware threat
landscape and addresses capability gaps and conducts retroactive threat hunts to assess
customer impact.

## Recommendations from eSentire’s Threat Response Unit (TRU)

While the TTPs used by adversaries grow in sophistication, they lead to a limited set of
choke points at which critical business decisions must be made. Intercepting the various
attack paths utilized by the modern threat actor requires actively monitoring the threat
landscape, developing, and deploying endpoint detection, and the ability to investigate logs &
network data during active intrusions.

We recommend implementing the following controls, mapped to specific tactics leveraged by
threat actors, to help secure your organization against the most impactful techniques
mentioned in the leaked Conti documents:

**Initial Access**

Require multi-factor authentication (MFA) on all remote access, including VPN.
Monitor remote access logs for unusual activity.
Protect endpoints against compromise using AV and/or an Endpoint Detection
Response (EDR) product.
Monitor for discovery tools and commands on protected endpoints.
Patch known vulnerabilities in software and operating systems.

**Credential Access & Privilege Escalation**


-----

Protect against Kerberos attacks by:

Using AES Kerberos encryption over RC4 and use complex, lengthy passwords
on service accounts.
Limiting service accounts to minimal required privileges and privileged groups
such as Domain Administrators.
Monitor for privileged account creation.

**Compromise Administrators**

Protect administrator workstations from compromise using anti-malware and endpoint
detection and response products.
Avoid storing cleartext credentials in files.
Use strong passwords for password managers and avoid saving them directly on the
system.
Enforce “least privilege” to limit access to the minimum required for the employee’s
specific job function.

**Exfiltrate Data**

Ensure EDR agents are deployed to key targets of ransomware actors including file
shares, email servers and domain controllers.
Monitor for data staging and exfiltration utilities such as 7zip, Rclone and FileZilla
Monitor for software used to proxy or tunnel network traffic, including TOR clients (The
Onion Router), NGROK and SSH clients (where not expected).

**Inhibit Recovery**

Implement regular backups and store them offline.
Harden administrative interfaces to backup services.

If you’re not currently engaged with a Managed Detection and Response provider, we highly
recommend you partner with us for security services in order to disrupt threats before they
impact your business.

[Want to learn more? Connect with an eSentire Security Specialist.](https://www.esentire.com/get-started)

### Skip To:

Key Takeaways:
Background
Breakdown by Intrusion Phase
How eSentire is Responding
Recommendations from eSentire’s Threat Response Unit (TRU)


-----