CONTI ransomware

Conti was a Russian-speaking ransomware operation active from 2020 to 2022 and is generally treated as the successor to Ryuk, since its first builds reused Ryuk code and note wording and arrived over the same TrickBot channels. Those early builds appended .CONTI and wrote CONTI_README.txt to each folder. A January 2022 update switched to a random five-character extension mixing upper and lower case and digits, such as .ZG7Ak, pointed victims to a readme.txt, and could set a wallpaper written to C:\ProgramData\conti.png. Each file gets its own ChaCha key, locked with an RSA-4096 key. Kaspersky's RakhniDecryptor handles Conti-family files renamed .KREMLIN, .RUSSIA or .PUTIN; files ending .CONTI or in a random five-character extension fall outside its stated coverage. Operators got in through spearphishing attachments that dropped TrickBot, IcedID or Cobalt Strike, through stolen or weak RDP logins, and through unpatched internet-facing systems. They harvested credentials with Mimikatz and Sysinternals tools, used Zerologon and PrintNightmare to gain higher rights, and spread across the domain before encrypting. Data was normally copied out with Rclone first and held over the victim with a threat of publication, so assume theft. US authorities counted more than 1,000 attacks by early 2022. In late February 2022 the crew's internal chats and its source code were leaked online, and that code has since been reused by a long tail of derivative strains.

Sources: CISA/FBI/NSA AA21-265A, Zscaler ThreatLabz, Kaspersky, Rapid7, Unit 42, BleepingComputer

File extensions: .CONTI, .7ec3rqvr, .ITTZN, .KKBKR, .LOCK2023, .MEOW, .PUTIN, bluesky, CECJF, CROW, CRYPT, DIDWQ, FEALC, FEEDC, i_mod_hacked, ILMWL, JMEQQ, KCWTT, KREMLIN, KWDDI, locked, LSNWX, MRBNY, NB65, PSFUX, PUUUK, QHCGS, QMIBK, TJODT, UWTJF

Ransom note filenames: readme.txt, R3ADM3.txt

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-29.

Scope: Kaspersky RakhniDecryptor lists Trojan-Ransom.Win32.Conti files renamed .KREMLIN, .RUSSIA or .PUTIN. It does not claim original .CONTI files or the random five-character extensions of later builds.

From the ransom note README.txt:

Key: [redacted] Write in Telegram to decrypt files - [@]LockContact2023

Sources: Kaspersky