Initial Intrusion Phase
A targeted phishing email impersonating a partner company or bank containing a malicious macro attachment ưhen the victim enables the macro the malware is downloaded
Exploiting vulnerabilities attacking software vulnerabilities such as VPN servers eg Fortinet Microsoft Exchange ProxyShellLog4Shell or RDP Remote Desktop Protocol services with weak passwords
Purchasing access buying existing access from other hacker groups specializing in selling initial access

Stage 2 Establish Foothold & Lateral Movement


Run tools Use Cobalt Strike PowerShell Empire or legitimate administrative tools LivingofftheLand like PsExec to avoid detection
Gather information Steal login credentials using mimikatz dump LSASS memory
Escalate privileges Exploit vulnerabilities or use stolen credentials to obtain AdministratorDomain Admin rights
Spread across the network Use acquired information to access other servers and workstations specifically targeting file servers and backup servers

Stage 3 Data Exfiltration

Search for data Scan for shared folders databases email servers containing financial data intellectual property personal information
Package and transfer out Compress encrypt and upload to cloud storage services such as Meganrz or their own servers using tools like Rclone FileZilla This process can last for days or weeks

Stage 4 Ransomware Deployment

Preparation Disable antivirus software delete shadow copies VSS to prevent recovery clear event logs
Encryption Deploy Conti ransomware either manually or automatically to all compromised machines Conti uses a combination of symmetric AES and asymmetric RSA encryption to lock files
Leave a note Place a READMEtxt or CONT1txt file on each affected machine with contact instructions and threats to leak data

Stage 5 Extortion and Negotiation

Contact via email or Tor website
Demand ransom often in the millions of USD in exchange for the decryption tool and deletion of stolen data
Employ double extortion tactics threatening both to withhold the decryption key and to publish the stolen sensitive data

The average Conti ransomware attack lasts