Conti Ransomware Decryption & Data Recovery

Conti was first catalogued in December 2019 and scaled through 2020. Descended from Ryuk, it was run by the Russian-speaking Wizard Spider crew - the TrickBot gang - as ransomware-as-a-service: a core team kept the encryptor, negotiation portal and Conti News leak site running while affiliates handled intrusion for a share.

The 14 May 2021 attack forced Ireland's Health Service Executive to shut down its national IT estate; only about 95 percent of servers and devices were back by September. Attacks on Costa Rican government bodies from 17 April 2022 led the country to declare a national emergency on 8 May. Joint advisory AA21-265A from CISA, the FBI and the NSA counted more than 400 attacks at first and more than 1,000 by its February 2022 update.

The turning point was 27 February 2022: after Conti publicly backed Russia, a Ukrainian researcher dumped roughly 60,694 internal chat messages from its Jabber servers, and the encryptor source code and admin panel followed days later. Washington posted rewards in May - up to USD 10 million for the leadership's identity or location and up to USD 5 million for arrests and convictions. The negotiation and admin panels went dark on 19 May and the leak and negotiation sites went offline on 23 June 2022. The FBI estimated that as of January 2022 there were over 1,000 victims and more than USD 150 million paid.

The brand died, the people did not. Research ties HelloKitty, AvosLocker, Hive, BlackCat, BlackByte and Karakurt to Conti personnel or infrastructure, and Black Basta and Royal/BlackSuit are widely held to have absorbed its crews; in July 2023 Arctic Wolf linked Akira to Conti-affiliated actors with high confidence, citing ransom-payment flows and code similarity. Enforcement continues: in May 2025 Germany's federal police named the syndicate's leader "Stern" as Vitaly Nikolaevich Kovalev, and on 11 September 2026 Ukrainian national Oleksii Lytvynenko was sentenced to four years in the US for his part in Conti attacks, having been arrested in Cork in July 2023 and pleaded guilty in June 2026. Conti now matters as a legacy: the tradecraft was inherited wholesale, the code still spawns new builds, and data encrypted in 2021-2022 still awaits a verdict.

Extensions. Early builds appended .CONTI; from 2021 a random five-letter uppercase string (.RHMLM, .UAKXC); from January 2022 a five-character mixed-case alphanumeric string (.ZG7Ak, .wjzPe) chosen to evade rules matching the all-uppercase pattern. An extension that looks random is therefore typical of Conti, not a reason to rule it out.

Ransom note. CONTI_README.txt, readme.txt, R3ADM3.txt or CONTI.txt are dropped in affected directories; the English text claims data theft and links to a Tor negotiation portal, with early builds also listing mail addresses. The wallpaper is normally untouched.

Derivatives. The .KREMLIN, .RUSSIA and .PUTIN extensions belong to MeowCorp, a third-party build made from the leaked source - not the original crew, yet the only strain with a public decryptor.

Bottom line. Anything labelled Conti after June 2022 is almost certainly a source-derived build or a misattributed successor; Black Basta, Royal and Akira each use different patterns. Attribution needs three to five encrypted files, the original note and the relevant logs.

Conti's access playbook was copied across the whole ransomware ecosystem in 2021-2022 and still describes the most common intrusion paths:

• Phishing that delivers a loader. Malicious attachments or links drop TrickBot, BazarLoader or IcedID, which stage Cobalt Strike; from 2021 BazarLoader and BazarBackdoor progressively replaced TrickBot as the main delivery channel.
• Stolen or weak RDP credentials. Straight logon with valid credentials, no exploit needed - the CISA advisory ranks this alongside phishing as a primary vector.
• Internet-facing vulnerabilities. The ProxyShell Exchange chain (CVE-2021-34473 / 34523 / 31207, documented end to end by Sophos) and FortiGate CVE-2018-13379 and CVE-2018-13374.
• Lateral movement and escalation. Mimikatz and ProcDump against lsass, Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) for privilege, then PsExec, MS17-010 and commercial remote-access tools such as AnyDesk, Atera, Splashtop and Remote Utilities. Log4Shell (CVE-2021-44228) belongs here rather than at the perimeter: in December 2021 threat intelligence recorded Conti using it inside already-compromised networks to reach VMware vCenter.
• Exfiltration. Rclone syncing data to Mega and similar cloud storage before encryption.

In one intrusion documented by The DFIR Report, about five days elapsed between initial infection and domain-wide deployment, and the encryptor was pushed to every domain-joined host by a batch script run from the backup server. Backups first, then everything else - the signature of this lineage.

Algorithms and speed. 2020 samples showed traces of both AES-256 and a ChaCha variant, and vendors were still documenting AES-256 in early 2021; the January 2022 update is confirmed as a per-file 256-bit ChaCha key. In every build that file key is wrapped with a victim-specific RSA-4096 public key that never touches disk. With up to 32 worker threads driven by I/O completion ports, Conti ranked in the fastest tier measured - the window between noticing trouble and losing everything is often tens of minutes.

Adjustable scope. The encryptor takes command-line flags. The deployment command recorded by The DFIR Report was -m -net -size 10 -nomutex -p \\HOST\C$, where -size 10 encrypts only a proportion of each file; later builds added -safeboot and -disablesafeboot. Partial encryption depends on those flags, so never assume it - measure the actual files.

Recovery inhibition. Shadow copies are deleted via vssadmin and WMI, up to 146 security, backup, database and mail services are stopped, and the Windows Restart Manager releases locked handles so live database files can be encrypted. Builds from January 2022 could reboot into Safe Mode with networking to sidestep security software.

Lateral and virtualisation. The encryptor reaches neighbouring hosts over SMB 445 and encrypts writable shares; published research also documents a Linux variant that encrypts virtual machine files directly on VMware ESXi hosts. Data was stolen before encryption and published in stages on Conti News.