The Demon Conti, Bookkeeper of Evil

Legend

Appearing in late 2019 and linked to Wizard Spider, it was among the most active ransomware between 2020 and 2022. It paralysed Ireland's health service in 2021 and pushed Costa Rica to declare a national emergency in 2022. In 2022 its internal chats leaked and the brand broke up into smaller groups.

Exorcism

Cast it out by closing the easy doors: phishing, exposed RDP, VPNs without MFA. A segmented network and a tested continuity plan make the blackmail far less effective.

Technical record

Circle: Circle III · Ransomware and extortion
First seen: c. 2019
Status: Dormant
Weapons (exploited CVEs): Saint Log4Shell, Martyr of JNDI · Saint Zerologon, Who Showed Up With Only Zeros · Saint ProxyShell, Who Entered Through Exchange
Works: The Scourge of Ireland's Health Service · The Scourge of Costa Rica

A ransomware-as-a-service operation linked to Wizard Spider, first seen in late 2019 and one of the most prolific gangs of 2020-2022. It crippled Ireland's health service in 2021 and led Costa Rica to declare a national emergency in 2022. After internal chats leaked in early 2022 it shut down in May-June 2022, with members dispersing to other groups.

Sources: attack.mitre.org · cisa.gov · MITRE ATT&CK reference S0575