What is Conti Ransomware?

Conti Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Healthcare and enterprise networks; operator-led encryption

Source Attribution

Origin: MITRE
Source: CISA · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2020-05 discovered Conti first observed
2022-05 updated Conti leadership split; operations declined

Quick Answer

Conti operators gain access via phishing and RDP, use Cobalt Strike, and deploy ransomware with partial data exfiltration and a negotiation chat.

Definition

Conti is a human-operated ransomware family known for aggressive attacks during 2020-2022, with leaked operational playbooks and ties to TrickBot development.

Overview

Conti is a human-operated ransomware family known for aggressive attacks during 2020-2022, with leaked operational playbooks and ties to TrickBot development.

Behavior

Rapid encryption campaigns
Cobalt Strike lateral movement
Negotiation chat portal

First Seen

2020-05

Target

Healthcare and enterprise networks; operator-led encryption

Techniques: T1486, T1567, T1078
Campaigns: n/a
Related CVEs: CVE-2021-26084

Malware Intelligence

Family: Conti Ransomware

Aliases: Conti

Techniques: T1486, T1567, T1078

Targets: Healthcare and enterprise networks; operator-led encryption

Behavior:

Rapid encryption campaigns
Cobalt Strike lateral movement
Negotiation chat portal

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Conti Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Conti Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.