According to Bleeping Computer, Advanced Intel’s Vitali Kremez analyzed Conti and found ransomware based off the code for Ryuk, another crypto-malware family. He also discovered that Conti was using the same ransom note template that early versions of Ryuk employed in their attack campaigns. Finally, Kremez revealed that Conti appeared to be using the same TrickBot infrastructure as Ryuk for its ransomware attack campaigns.
The security researcher didn’t go as far to say that Conti was the direct successor to Ryuk. However, he did cite ID-Ransomware data as supporting evidence. He specifically pointed to the fact that submissions of Conti to the service had increased at a time when reports involving Ryuk were on the decline.
A Look Inside Conti’s Functionality
Carbon Black’s Threat Analysis Unit (TAU) researchers found a digital threat in Conti that in many ways behaved like a standard ransomware family. The sample they analyzed iterated files on the local system and on remote Server Message Block (SMB) network shares. Ultimately, it leveraged AES-256 via a hard-coded public key to perform its encryption routine.
But, TAU found some important characteristics that set Conti apart from other modern ransomware. First, researchers observed the ransomware family employs several different anti-analysis methods. These techniques include applying a string coding routine to nearly every string text of the malware. As a result, Conti hides the Wind ..
Support the originator by clicking the read the rest link below.
