eSentire Conti Leaks Analysis

Industry: N/A | Level: Tactical | Source: eSentire

eSentire’s Threat Response Unit (TRU) dove into Conti intrusion procedures sharing detection tactics from the group's 2021 and 2022 data leaks containing operation manuals and chat logs. The ransomware group's chat logs, from the recent February 2022 data leak, often reference the usage of manuals that assist Conti operators to carry out their operations. The ransomware gang operates with a clear structure, involving a management chain, organized personnel with roles and responsibilities and training programs. The reference materials help to ensure Conti operators initiate their threat activity with consistency and efficiency. Analysis of the tools identified the reliance on many known tools and techniques including AdFind, Cobalt Strike, Mimikatz, Powerview, 7zip, AnyDesk, Rubeus, Rclone and native living off the land binaries (LOLBins).

• Anvilogic Scenario: ZeroLogon Compromise
• Anvilogic Use Cases:
• Adfind Commands
• Adfind Execution
• Common Reconnaissance Commands
• Cobalt Strike Beacon
• Cobalt Strike style Shell invocation
• Create/Add Local/Domain User
• Locate Credentials
• Mimikatz
• Modify Group Policy
• Native Archive Commands
• Potential Web Shell
• Registry key added with reg.exe
• Rclone Execution