Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 13:03:35 UTC
Home > List all groups > List all tools > List all groups using tool Conti
 Tool: Conti
Names Conti
Category Malware
Type Ransomware, Big Game Hunting
Description
(Carbon Black) Conti uses a large number of independent threads to perform encryption,
allowing up to 32 simultaneous encryption efforts, resulting in faster encryption
compared to many other families.
Conti also utilizes command line options to allow for control over how it scans for data,
suggesting that the malware may commonly be spread and directly controlled by an
adversary. This control introduces the novel ability of skipping the encryption of local
files and only targeting networked SMB shares, including those from IP addresses
specifically provided by the adversary. This is a very rare ability that’s previously been
seen with the Sodinokibi ransomware family.
Another new technique, documented in very few ransomware families, is the use of the
Windows Restart Manager to ensure that all files can be encrypted. Just as Windows will
attempt to cleanly shut down open applications when the operating system is rebooted,
the ransomware will utilize the same functionality to cleanly close the application that
has a file locked. By doing so, the file is freed up for encryption.
Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6c920e0b-25d1-4496-b7d2-4cdf5b9d0b9b
Page 1 of 3

MITRE ATT&CK Malpedia AlienVault OTX Playbook
Last change to this tool card: 05 September 2023
Download this tool card in JSON format
All groups using tool Conti
Changed Name Country Observed
APT groups
 Wizard Spider, Gold Blackburn 2014-May 2025
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6c920e0b-25d1-4496-b7d2-4cdf5b9d0b9b
Page 2 of 3

1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6c920e0b-25d1-4496-b7d2-4cdf5b9d0b9b
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6c920e0b-25d1-4496-b7d2-4cdf5b9d0b9b
Page 3 of 3