Conti Team

The Conti team, a threat actor group known for its malicious activities in the cyber realm, has seen significant developments and transformations over recent years. In September 2022, a splinter group from Conti Team One resurfaced under the name Royal Ransomware, conducting callback phishing attacks with tactics, techniques, and procedures (TTPs) similar to those previously used by the original Conti team. Some researchers suspect that this new group may consist of former Conti members who compromised Conti Team One. Another individual, Akira, was observed to have close ties with the Ryuk side of post-Conti, leading to a relationship with Zeon - formerly Conti Team One, which ran TrickBot, further illustrating the complex web of relationships within these threat actor groups. In response to perceived threats from Western nations, the Conti Team announced their intention to retaliate against any cyber warfare attempts targeting critical infrastructure in Russia or Russian-speaking regions. This aggressive stance demonstrates the group's readiness to leverage their cyber capabilities in geopolitical conflicts. Meanwhile, another threat actor group named Monti emerged, deliberately emulating the TTPs of the Conti team, incorporating many of their tools, and even using Conti’s leaked source code. This suggests an ongoing influence of Conti's methods on emerging cybercriminal activities. By 2024, LockBitSupp, a sub-group largely drawn from the Zeon group (formerly known as Conti Team 1), had become a significant player, serving "as a mere distraction for actual operations." They pretended LockBit was still a Ransomware-as-a-Service (RaaS) group, drawing attention to its data-leak blog, while most of its profits came from small teams of pentesters. This indicates the evolution and diversification of strategies employed by these threat actors, highlighting the need for continuous vigilance and adaptive countermeasures in the cybersecurity landscape.