malware family

Conti

unknownentity:malware_familyransomware · 1 source

Conti ransomware is a RaaS and has been observed encrypting networks since mid-2020.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: conti
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 236 · 0 attributions · 1 relations · 0 events

Identifiers

attack S0575via mitre-attack
misp-galaxy 201eff54-d41e-4f70-916c-5dfb9301730avia misp-galaxy-ransomware

Relations

MITRE ATT&CK Enterpriserecords thatWIZARD SPIDERusesConti
fetch —sha256 dc1639caa5501d72
rel_586btcintel:relations:586@v1 sha256:49c8a44f5d3ae234
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 236

Contiransomwarepayment
subjecttransaction1b5e63dd8b…260f82bf9d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3JDzTo87HrpQSVhqUejwv2DrxiL9vcaDXN · 3,000,079,343 sat · time 2020-09-23 01:09 UTC · url https://ransomwhe.re/#address/3JDzTo87HrpQSVhqUejwv2DrxiL9vcaDXN
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32287btcintel:annotations:32287@v3 sha256:ad0b6099ebdafad6
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress3JDzTo87HrpQSVhqUejwv2DrxiL9vcaDXN
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/3JDzTo87HrpQSVhqUejwv2DrxiL9vcaDXN
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32286btcintel:annotations:32286@v2 sha256:f4781e9639962733
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction373fc2e82d…eb141d5876
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q8ylqa3w37hsuel983yygn02qr3crsw75mg9fjd · 4,132,616,491 sat · time 2022-06-21 20:52 UTC · url https://ransomwhe.re/#address/bc1q8ylqa3w37hsuel983yygn02qr3crsw75mg9fjd
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32285btcintel:annotations:32285@v3 sha256:70fcd6dc81fee32a
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddressbc1q8ylqa3w37hsuel983yygn02qr3crsw75mg9fjd
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/bc1q8ylqa3w37hsuel983yygn02qr3crsw75mg9fjd
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32284btcintel:annotations:32284@v2 sha256:2a9e99dd6350666f
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction9b5217fe34…3b17e6f899
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe · 2,800,000,000 sat · time 2019-05-17 18:49 UTC · url https://ransomwhe.re/#address/3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32283btcintel:annotations:32283@v3 sha256:f0086a9e281e1601
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransactionde2e984f86…12fe8350ba
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe · 2,000,000,000 sat · time 2019-05-20 19:15 UTC · url https://ransomwhe.re/#address/3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32282btcintel:annotations:32282@v3 sha256:bdeb2f8dd9c3eb18
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/3Qdcku7zn25YrpPSAfBtEZ5wHb9vhWEFPe
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32281btcintel:annotations:32281@v2 sha256:7920eefedf105222
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransactiona653d87f6e…528587c4e0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3NsgkAq5YnJDFURU29b83kqMaghhbyevUp · 3,000,096,760 sat · time 2019-12-18 21:13 UTC · url https://ransomwhe.re/#address/3NsgkAq5YnJDFURU29b83kqMaghhbyevUp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32280btcintel:annotations:32280@v3 sha256:5d8ca0c591137d73
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress3NsgkAq5YnJDFURU29b83kqMaghhbyevUp
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/3NsgkAq5YnJDFURU29b83kqMaghhbyevUp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32279btcintel:annotations:32279@v2 sha256:e15608c82e619a13
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction29acee8486…c18c207d01
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N · 14,000 sat · time 2019-10-21 13:28 UTC · url https://ransomwhe.re/#address/3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32278btcintel:annotations:32278@v3 sha256:7e598b4ac530e392
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction3a32e5bd27…a7cce695ae
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N · 12,000,000,000 sat · time 2019-10-21 17:42 UTC · url https://ransomwhe.re/#address/3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32277btcintel:annotations:32277@v3 sha256:e0a97fa85291f128
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/3N76Z9oJctXJyAE2cxMnVUuVJTBTMar81N
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32276btcintel:annotations:32276@v2 sha256:576f5dbd39cc7f01
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction308a9a0b14…4a49855fdb
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3DVoasYjENgEoTdPv62anDZATKoc8YF52B · 1,800,097,165 sat · time 2020-01-15 20:50 UTC · url https://ransomwhe.re/#address/3DVoasYjENgEoTdPv62anDZATKoc8YF52B
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32275btcintel:annotations:32275@v3 sha256:825c9b976a32ee6d
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction966306a551…fb708280a6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3DVoasYjENgEoTdPv62anDZATKoc8YF52B · 5,800,097,300 sat · time 2020-01-23 22:14 UTC · url https://ransomwhe.re/#address/3DVoasYjENgEoTdPv62anDZATKoc8YF52B
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32274btcintel:annotations:32274@v3 sha256:072d7068e06c44b6
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress3DVoasYjENgEoTdPv62anDZATKoc8YF52B
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/3DVoasYjENgEoTdPv62anDZATKoc8YF52B
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32273btcintel:annotations:32273@v2 sha256:7c98b7f434125b92
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction127356208b…e1214739ff
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx · 70,000,093,813 sat · time 2020-09-07 21:24 UTC · url https://ransomwhe.re/#address/bc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32272btcintel:annotations:32272@v3 sha256:2e46e073456ece56
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddressbc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/bc1q646fx2g833cvtg9t65ldfhswn9f83xg5y9zffx
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32271btcintel:annotations:32271@v2 sha256:2aa156dd2488df91
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction879035a1d3…ac094f9ba1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 37x8uirHH9iQxGFQb7TUNU7tw1ub3pg6Gr · 2,000,070,490 sat · time 2020-09-04 14:38 UTC · url https://ransomwhe.re/#address/37x8uirHH9iQxGFQb7TUNU7tw1ub3pg6Gr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32270btcintel:annotations:32270@v3 sha256:123ab494b5bfaece
confidencetrusted provider · 50
Contiransomwarepayment address
subjectaddress37x8uirHH9iQxGFQb7TUNU7tw1ub3pg6Gr
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Conti · url https://ransomwhe.re/#address/37x8uirHH9iQxGFQb7TUNU7tw1ub3pg6Gr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32269btcintel:annotations:32269@v2 sha256:6bef9553ed2de7ca
confidencetrusted provider · 50
Contiransomwarepayment
subjecttransaction8d9bba6fc9…22a789b203
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 34EgpqB3Bo8mANPK8F4R8RDhCWdgxdXFDa · 2,700,010,000 sat · time 2019-11-08 23:14 UTC · url https://ransomwhe.re/#address/34EgpqB3Bo8mANPK8F4R8RDhCWdgxdXFDa
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32268btcintel:annotations:32268@v3 sha256:ab8f48ddf21eb0ef
confidencetrusted provider · 50

Subjects236 subjects carry a claim naming this entity · a sample

13sBMhTkri6be75TVQKHqtUo3LuLJRaY8paddress
13XELohdTXGbgHpwRrNHMiuKrjA7a9wM2zaddress
15pBv8xf2CbqJ1eqphAPyD1XZdMfuioVdUaddress
1JWnZmkJwJSK6F21nypCAGzsR6TVhPRA4Paddress
1KUzq13qqefyBoHtiS7J8E9uHhZiRwgxvMaddress
1L1FZ9pB95doi1sAMDuG9xVFhdeB412tHaddress
1Lc1pysi5ofcvm6Tu298SDsX5dzLu5Hdvgaddress
1LYiEgq9k3xSAddbqMZcsVTayJVoKbTFubaddress
1MsusXiW9vUpmz2tcDyPdP5SSkngVTHHviaddress
1MuBnT25CQeTFYkx1tHP4Fa5rKbc4rC9uFaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.