Conti

THREAT ACTOR PROFILE

Conti

Conti was one of the most damaging ransomware operations of its time, active from 2020 until its breakup in 2022. Run by the Russia-based Wizard Spider ecosystem, it was known for fast encryption, big-game hunting, and a structured, almost corporate operation whose internal chats leaked and reshaped the ransomware landscape.

Russia-based

Ransomware (cross-sector)

First seen

2020

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Conti and the Wizard Spider ecosystem

Conti was the ransomware brand of the Wizard Spider cybercrime ecosystem, the same group behind TrickBot and Ryuk. In our record it is a single entry among the threat actor profiles we maintain, tied to that broader ecosystem.

GROUP PROFILE

A corporate-style ransomware operation

Conti ran like a business, with salaried roles, internal tooling and a double-extortion leak site. It practiced big-game hunting, hitting large enterprises and healthcare, and was behind high-profile attacks including the 2021 attack on Ireland's health service.

Our record ties it to ransomware across many sectors, with over a thousand victims before its breakup. Its people and code did not disappear: they seeded successor operations including Black Basta and Akira, along with Royal and Quantum.

Conti's downfall came from within. After it declared support for Russia's invasion of Ukraine in 2022, a leaker published its internal chats and source code (the "ContiLeaks"), and the brand wound down soon after.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Loaders and Cobalt Strike into fast encryption

The stages below come from Conti activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

TrickBot, BazarLoader and the Conti encryptor

Initial Access

CVES EXPLOITED

VPN, Windows and Exchange flaws

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

Conti

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Conti

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Conti

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Fast intrusions and the post-leak playbook

The reporting captures both Conti's operational speed and what its leaked material revealed.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.