Conti Ransomware Recovery - A Nightmare for Big Corporations

Is CONTI Ransomware holding your data hostage? If it is, you have may have an emergency, but say calm. Conti ransomware is known to attack companies and organizations of all sizes, and is one of the costliest ransomware strains affecting businesses. It is a re-branding of the RYUK ransomware variant which surfaced in June of 2020.

This page contains essential information about Conti ransomware, decryption, recovery, removal and statistics. Please review the information below and contact our support team, to get immediate help with Conti ransomware removal and recovery.

What is Conti Ransomware and how does it infect my files?

RYUK, first discovered in August of 2018, has already wreaked havoc for multiple large corporations and medium companies. Conti surfaced in July 2020 with behavior and ransom notes eerily similar to RYUK, such as AES 256 bit military grade encryption combined with RSA 4096.

Similar to Ryuk, Conti ransomware is particularly threatening for corporations and organizations that operate large and complex network infrastructure. While it has similarities to Ryuk’s source code and modus operandi, Conti is smarter, quicker and faster in encrypting data while shutting down entire networks. The connection between Ryuk and Conti is further supported by the fact that Conti attacks are increasing as Ryuk attacks decline.

The AES 256/RSA 4096 encryption alongside 32 simultaneous encryption threads used to encrypt files at unsurpassed speeds is what makes this an extremely dangerous malware for medium to large sized organizations. This means that the Conti ransomware can encrypt an entire network much faster than most other existing strains of ransomware, making it more difficult to catch and stop before it disrupts operations.

Here are some signs of a CONTI attack:
You receive a file titled: CONTI_README.TXT telling you that your data is encrypted and demanding a payment, often in the millions of dollars.
File extensions change to an extension containing five alphabetical characters in uppercase, such as .CONTI
Firewall logs show significant unusual traffic to and from the network. This is usually indicative of data exfiltration.
As many as 146 Windows application all related to security, backup and database are immediately blocked, rendering your security SOP’s useless.
Extremely slow and sluggish operation of computers on the network resulting from file encryption.

What should I do when my data has been encrypted by CONTI Ransomware?

Conti is a smarter, more sophisticated and more dangerous variant of Ryuk ransomware. Corporations often find themselves targeted by Conti attacks. Since the targets are usually larger corporations and organizations, the ransom payment demanded is also usually much higher than many other ransomware cases.

If and when you find your systems in the middle of the encryption process, we strongly recommend you turn off all the machines connected to your network to minimize data loss.

This can also help to contain the spread of virus to backups.

For more details about the steps to take after discovering a ransomware infection, please visit our ransomware response guide.

Don’t attempt to decrypt the files on your own. So far, there is no free or paid decryption tool for Conti ransomware, but there are scammers that will offer easy fixes. The only way to decrypt the files is by obtaining the decryption key from the attackers.

BeforeCrypt is as a serious and highly-effective partner if your network is infected by Conti ransomware. Our team is experienced in negotiating with attackers and settling payments quickly and securely. We keep up-to-date case records on various ransomware gangs that help us to better negotiate lower ransom payments. We also have experience with all matters relating to legal and insurance compliance, as well as ransomware removal and secure decryption practices.

Keep calm! Contact us, and we can help you!

Ransomware Recovery Ransomware Decryption

CONTI RANSOMWARE STATISTICS & FACTS

RANSOM AMOUNTS

Conti targets corporations and enterprises with a large IT infrastructure. As such, ransom payments are often much higher than other variants, often in line with Ryuk.

The average Conti ransom amount is somewhere between $100,000–$350,000. However, some attackers have even demanded as high as $800,000 to over $1 Million. When purchasing Bitcoin to pay a ransom, quick-buy methods include a fee of as much as 10%.

AVERAGE LENGTH OF CONTI INCIDENT

Since Conti attacks corporations, the average length of incident is longer than other ransomware. This is because of the manual communication with attackers through email, which adds a considerable delay in the response time and data recovery process.

Since this is an enterprise-level attack, the longer your systems and files are held hostage, the costlier it will be in terms of PR damage. Your goal should be to get your systems back to productive state as soon as possible. The best way to do this is to call in experts like BeforeCrypt, who have a vast knowledge of this ransomware. We can help you in getting your network back up running.

CASE OUTCOMES

There is a high chance to get a working Conti decryptor after paying the attackers. But there’s never a guarantee to get a working decryption key at all. Since this is a new variant surfacing in June 2020, we still need more data to confirm whether or not a working decryptor is provided by attackers.

COMMON ATTACK VECTORS

It is in most cases either Remote Desktop Protocol or email Phishing are the 2 leading attack vectors. Unfortunately, even enterprises fail to secure their open RDP ports.

Due to an increase in remote working, a lot of employees now work from home using remote desktop control, leaving the company’s network exposed to hackers and all sorts of cyber criminals. But it isn’t limited to Remote Desktop Protocol.

In fact, the most common methods of this ransomware distribution is email phishing.

	CONTI MALWARE SUMMARY
Name	CONTI Virus / CONTI Ransomware / CONTI Malware
Danger level	Extremely high. Targets corporations and uses 32 simultaneous methods for faster encryption
Release date	June, 2020
OS affected	Microsoft Windows
Appended file extensions	.CONTI
Ransom note	ContiReadMe.txt, CONTI_README.txt
Contact email address	[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], e[email protected], [email protected]

HOW TO IDENTIFY CONTI RANSOMWARE

Conti Note #1: CONTI_README.TXT File

Conti Ransom Note #2: Text file

It has been observed that another variation of the Ransom note with all details is exactly similar to the RYUK variant, as follows:

Gentlemen!
Your business is in serious danger.
There is a significant hole in your company’s security system. We’ve just penetrated your network.
You should thank the Lord that you were hacked by serious people and not by stupid schoolboys or dangerous punks.
They can damage all your important data just for fun.
Now your files are crypted using the strongest military algorithms RSA 4096 and AES-256.
No one can help you recover files without our special decoder.
Photorec, RannohDecryptor etc. repair tools are useless and can destroy your files irreversibly.
If you would like to restore your files, write an email to (Contacts are an the bottom of the sheet)
and attach 2-3 encrypted files (Each less than 5Mb, not archived and your files should not contain
valuable information (Databases, backups, large Excel data sheets, etc.).
You will receive decrypted samples and our conditions on how to get the decoder.
Don’t forget to write the framework of your company in the subject of your email.
You have to pay for decryption in bitcoins. The final price depends on how quickly you write to us.
Every day of delay will cost you an additional +0.5 BT. Nothing personal, just business
As soon as we get bitcoins, you’ll get all your decrypted data back.
Moreover you will get instructions on how to close the hole in security and how to avoid such problems in the future
+ We will recommend you special software that makes the most problems to hackers.
Attention! One more time!
Do not rename encrypted files.
Do not try to decrypt your data with third party software.
P.S. Remember, we are not scammers.
We don’t need your files and information.
But after 2 weeks, your files and keys will be deleted automatically.
Just send a request right after the infection.
All data will be restored absolutely.
Your warranty – decrypted samples.
Contact emails
BTC wallet:
<unique-wallet>
Conti
No system is safe

There is almost always a * .txt or *.html file in every encrypted folder. The text file is usually named “CONTI_README.txt” or “CONTIREADME.html” and contains all the information information to contact the Conti attackers. It’s usually safe to open this file, just be sure the full file extension is *.txt or *.html.

Conti Ransomware: Modified Filename Extensions

Conti file names show a different file extension. Unlike other ransomware variants, Conti doesn’t includes an attacker email address or a unique ID in the filename. (Reference: BleepingComputer.com)

“file name.png.Conti”

FREQUENTLY ASKED QUESTIONS

How Does CONTI Ransomware Encrypt Files?

Conti encrypts each file with AES 256 bit encryption, and further encrypts with RSA 4096 bit public key encryption. This is done with simultaneous usage of 32 threads.

Can you decrypt my Conti Ransomware Files?

Depending upon the availability of decryptor, which seems impossible right now, there are slim chances of recovering your data. We can negotiate with the hackers to bring down the ransom payment and have a smooth recovery process.

How Does CONTI Ransomware Encrypt Files?

Backup, Backup, Backup! Use a separated backup destination like a secure cloud storage provider or a local backup medium, which gets physically disconnected after a successful backup run.
Install a Next-Gen-Antivirus. It combines a classic signature-based antivirus with powerful exploit protection, ransomware protection and endpoint detection and response (EDR).
Install a Next-Gen-Firewall. A Next-Gen-Firewall is also called Unified threat management (UTM) firewall. It adds a layer of security at every entry and exit point of your company data communication. It combines classic network security with intrusion detection, intrusion prevention, gateway antivirus, email filtering and many more.

Why Choose BeforeCrypt for CONTI Ransomware Recovery and Decryption Services?

Safe & Secure Negotiations with Proven Record of Success in Reducing Payments
Insurance Case Development and Documentation for Easy Claim Filing
Reporting Crime to Relevant Authorities with Full Legal and Regulatory Compliance
Ready Availability of Different Cryptocurrencies for Immediate Disbursement
FREE Threat and Damage Assessment
The Fastest Way to Get Your Systems Back Online