eSentire Conti Leaks Analysis

eSentire’s Threat Response Unit (TRU) dove into Conti intrusion procedures sharing detection tactics from the group's 2021 and 2022 data leaks containing operation manuals and chat logs. The ransomware group's chat logs, from the recent February 2022 data leak, often reference the usage of manuals that assist Conti operators to carry out their operations. The ransomware gang operates with a clear structure, involving a management chain, organized personnel with roles and responsibilities and training programs. The reference materials help to ensure Conti operators initiate their threat activity with consistency and efficiency. Analysis of the tools identified the reliance on many known tools and techniques including AdFind, Cobalt Strike, Mimikatz, Powerview, 7zip, AnyDesk, Rubeus, Rclone and native living off the land binaries (LOLBins).