• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Update – Anonymous Collective – Russian-Ukrainian Cyber Warfare
February 28, 2022
Rewterz Threat Advisory – Multiple Apache JSPWiki Vulnerabilities
February 28, 2022

Rewterz Threat Update – Conti Ransomware Group’s Data Leaked

February 28, 2022

Severity

High

Analysis Summary

Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted networks and threatens to disseminate it unless the ransom is paid. Conti ransomware enhances performance by utilizing “up to 32 simultaneous encryption operations,” and is very likely directly controlled by its controllers. This ransomware can target network-based resources while ignoring local files. This feature has the noticeable impact of being able to create targeted harm in an environment in a way that might hinder incident response actions.

In support of Ukraine against Russia, a security researcher released 13 months of sensitive data against the Russian nation-state actor, Conti. The data includes chat logs between the members of Conti and their victims with bitcoin address, and it also contains manuals on deployment of the Cobalt Strike. 

update-1646037560.png
update-1646037665.png

The Conti data is “a must-read for any security professional because it gives you an insight of how ransomware really works,” Holden says.

There are around 150 bitcoin addresses, chat handles, IP addresses, control panels and other infrastructure data that will be immensely useful for tracking the gang as well as the affiliates who use its malware, Liska says. 

vxshot.jpg

IOCS:

IP:

  • 138.124.180.94
  • 45.14.226.47
  • 193.203.203.101
  • 5.141.22.50
  • 62.197.136.15

Domain Names:

  • jaguar-zxy.info
  • lynx-abc.info

Please note that while the IOCs may not be malicious, they were extracted directly from the Conti data leak and hence have been used by the group members for internal communication and attacks.

Impact

  • File Encryption
  • Cyber Espionage
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.