Conti Ransomware
One of the most destructive ransomware operations in history, active 2020–2022. Dissolved after the Conti Leaks. Analysis based on 32 negotiation transcripts spanning the group's full operational period.
One of the most destructive ransomware operations in history, active 2020–2022. Dissolved after the Conti Leaks. Analysis based on 32 negotiation transcripts spanning the group's full operational period.
Conti operated as one of the most prolific and technically capable ransomware groups from approximately mid-2020 until May 2022. The group was closely associated with the TrickBot/BazarLoader ecosystem and is widely assessed to be a successor operation to Ryuk ransomware, sharing significant personnel and tooling overlap. Unlike the fully decentralised RaaS model of groups like LockBit, Conti operated with a more structured, corporate-like hierarchy. Internal communications leaked in early 2022 revealed a professional criminal organisation with dedicated departments for development, negotiation, HR, and management — functioning much like a legitimate software company.
The Conti Leaks (February–March 2022) were triggered after Conti publicly sided with Russia following the invasion of Ukraine, provoking a Ukrainian security researcher to leak approximately 168,000 internal Jabber chat messages spanning from January 2021 to February 2022, along with source code, operational playbooks, and training materials. This leak provided an unprecedented window into ransomware group operations and directly led to Conti's dissolution. Key members were identified and the group formally disbanded in May 2022, with personnel dispersing to successor groups including BlackBasta, Royal, Quantum, and BlackByte.
Conti's primary initial access mechanism was TrickBot and BazarLoader malware, delivered through sophisticated phishing campaigns. The group had a symbiotic relationship with the TrickBot botnet operators, with compromised systems from TrickBot infections regularly handed off to Conti operators for ransomware deployment.
The leaked Conti playbooks detailed their post-compromise methodology with unusual specificity, including step-by-step instructions for:
Conti also conducted opportunistic exploitation of known vulnerabilities in public-facing systems, including Fortinet FortiGate (CVE-2018-13379), Microsoft Exchange (ProxyShell), and VMware vCenter vulnerabilities.
The Conti encryptor was written in C++ and was designed for speed and stealth. Key technical characteristics include:
Conti operated a dedicated negotiation team, and the Conti Leaks revealed the internal communications of negotiators managing multiple active victims simultaneously. Our 32 transcripts, combined with the leaked internal data, provide an unusually comprehensive picture of Conti's negotiation approach.
Initial demands were calculated as a percentage of the victim's estimated annual revenue, typically targeting 1–3% for small organisations and up to 10% for larger enterprises. Demands routinely reached into the millions of dollars, with some large enterprise demands exceeding $25M. The leaked communications confirmed that negotiators operated under internal guidelines for minimum acceptable settlements and were required to obtain management approval before agreeing to reductions below certain thresholds.
Conti negotiators maintained a professional, transactional tone in communications with victims. The leaked internal chats, however, revealed a very different internal culture — negotiations were frequently mocked, and victims who showed distress were seen as weak positions to exploit. Negotiators were coached to maximise payment rather than settle early, with internal targets for deal closure.
The group operated a data leak site ("Conti News") where stolen victim data was published to increase pressure. In practice, our transcript data shows that Conti published data on organisations that refused to pay or whose negotiations broke down, but the threat of publication was also used as leverage throughout the negotiation process.
Conti's dissolution in May 2022 did not end the threat from its personnel or tooling. Key members and subgroups transitioned to or created the following successor operations:
The Conti encryptor source code, leaked in March 2022, has been repurposed by multiple subsequent threat actors, extending Conti's technical legacy well beyond the group's formal dissolution.
All 32 Conti ransomware negotiation transcripts are available in our public archive, documenting negotiations across the group's 2020–2022 operational period.
| Status | DEFUNCT |
| Active Period | 2020 – May 2022 |
| Transcripts | 32 |
| Demand Range | $1M – $25M+ |
| Model | Corporate RaaS / Double Extortion |
| Primary Targets | All sectors, enterprise focus |
| Entry Vectors | TrickBot, BazarLoader, phishing |
| Dissolved | May 2022 (post-Conti Leaks) |
| Tone | Professional externally, aggressive internally |
| Negotiability | Moderate (internal approval required) |
| Timeline Pressure | High |
| Data Leak Site | Conti News (now offline) |
| Min Settlement | Internal thresholds documented in leaks |
Black Basta and other Conti successors continue to operate. If you're facing an incident from a Conti-affiliated group, our team has direct experience with their tactics and negotiation patterns.
Get Emergency Help