Translated: Talos' insights from the recently leaked Conti ransomware playbook
Summary: Cisco Talos obtained and fully translated into English a leaked Conti ransomware playbook written mostly in Cyrillic, allegedly released by a lower-level affiliate known as "m1Geelka" who claimed Conti did not pay them. The playbook centers on the Cobalt Strike red-teaming framework and a translated Russian Active Directory attack manual, and lists tools including AdFind, whoami, Armitage, SharpView, SharpChrome, SeatBelt and GMER, with the alleged salary for a Conti pentester cited at around $1,500 USD.
What's compelling: Talos' main takeaway is that the playbook's detail could let amateur adversaries carry out destructive ransomware attacks, a much lower barrier to entry than other forms of attack. In at least one Conti engagement, CTIR assessed with high confidence that the adversary potentially had access to every account in the Active Directory environment.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·