CISA Update: US-CERT NCAS Alert (AA21-265A – Conti Ransomware)

The US-CERT National Cyber Awareness (NCAS), Alert AA21-265A entitled “Conti Ransomware” was first released on September 22, 2021.

The Alert was recently updated on February 28, 2022: “Conti cyber threat actors remain active and reported Conti ransomware attacks against the U.S. and international organizations have risen to more than 1,000. Notable attack vectors include Trickbot and Cobalt Strike.”

Technical Details

While Conti is considered a ransomware-as-a-service (RaaS) model ransomware variant, there is variation in its structure that differentiates it from a typical affiliate model. It is likely that Conti developers pay the deployers of the ransomware a wage rather than a percentage of the proceeds used by affiliate cyber actors and receives a share of the proceeds from a successful attack.

OODA Loop Sponsor

Conti actors often gain initial access [TA0001] to networks through:

Spearphishing campaigns using tailored emails that contain malicious attachments [T1566.001] or malicious links [T1566.002];
- Malicious Word attachments often contain embedded scripts that can be used to download or drop other malware—such as TrickBot and IcedID, and/or Cobalt Strike—to assist with lateral movement and later stages of the attack life cycle with the eventual goal of deploying Conti ransomware. [1],[2],[3]
Stolen or weak Remote Desktop Protocol (RDP) credentials [T1078].[4]
Phone calls;
Fake software promoted via search engine optimization;
Other malware distribution networks (e.g., ZLoader); and
Common vulnerabilities in external assets.

While there are no specific or credible cyber threats to the U.S. homeland at this time, CISA, FBI, and NSA encourage organizations to review this advisory and apply the recommended mitigations.

Russian Non-State Cyber Actors Align with Russian State

In early February, We first provided an analysis of the cybercrime crackdown by Russian authorities, which included the arrest of members of the REvil Gang. Later, we learned that a REvil gang arrestee is tied to the 2021 Colonial Pipeline attack in the U.S. Overall, follow-up reports suggested a growing sentiment that the Russian authorities were out to optimize the appeasement value to the U.S. of this arrest. We later suggested that the REvil gang arrest (and offering up the individual connected to cyberattacks in the U.S.) was possibly a false flag.

Our suggested scenario at the time: The Russians gave up the REvil gang while still planning to lean on non-state actors within Russia for plausibly denial cyberwar operations against Ukraine and/or information war efforts which enable a ‘small footprint’ invasion of Ukraine. Our latter assumption has proven true. A few days ago, the Conti Gang announced their support for the Russian Government.

According to OODA CTO Bob Gourley: “This [announcement by Conti] leads to the logical conclusion that the Russian arrests of REvil and other crooks were not just a signal to the West that they had ransomware under control and would unleash them if they wanted, but was a way to ensure total cooperation of all criminal groups.”

A Ukrainian Researcher (an Ex-Conti Gang Member) Leaks Group Chats

Recorded Future Analyst Dmitry Smilyanets has confirmed the authenticity of conversations leaked by a Ukrainian member of the gang (who was not pleased with the announcement of support for Russia by Conti). The leaked conversations are the result of the Ukrainian member of the group hacking the gang’s internal Jabber/XMPP server. The leaked data contains 339 JSON files with log conversations from January 29, 2021, to February 27, 2022. The leaked data has been made available by security firm IntelligenceX and can be read online. (1)

What Next: The Conti Gang APT and the Log4Shell Attack Chain

As we reported back in December 2021 and according to Palo Alto Networks, the Conti Gang was the first ransomware group to weaponize Log4Shell with a full attack chain. Palo Alto Networks refers to the group “as one of the most ruthless ransomware groups known to be active.” Conti has been able to leverage the Log4Shell vulnerability quickly and develop the attack chain. While some experts have the perspective that most attackers have lost interest in Log4Shell as a tool for cyberattacks, other reports confirm that nation-state threat groups continue to exploit the vulnerability. As recently as December of last year, Log4Shell appeared in hacker chatter.

The potential here is that the Conti Gang has already achieved broad access to U.S. systems via the Log4Shell vulnerability – and is simply awaiting an order from the Kremlin to mount an offensive attack.