extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Conti

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Conti in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

The record distinguishes the Conti ransomware software, the operation around it, and other groups reported to have used the software. No blanket successor claim is made.

Source name
Conti
Canonical lineage name
Conti
Entity model
operation
First observed
December 2019
Last observed
Date not established
Current status
Not established

Documentary media

First page of federal indictment 3:23-cr-00092 naming four defendants in a Conti ransomware case
Conti-related federal indictment previewFirst page of the Middle District of Tennessee indictment later unsealed with DOJ's 7 September 2023 charging announcement. An indictment is an allegation; the defendants are presumed innocent unless proven guilty.U.S. Department of Justice, Middle District of Tennessee · published 2023-09-07 · Primary evidenceEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedThe first page of an official court filing is reproduced at reduced resolution to identify and discuss the cited record. DOJ's policy warns that third-party material and official insignia may have separate restrictions; no broader rights claim is made.Source: U.S. Department of Justice and U.S. District Court for the Middle District of Tennessee, case 3:23-cr-00092.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

Relationships shown from this actor's perspective
Related actor or familyRelationshipPeriodConfidenceEvidence summarySources
LockBitoperation Code overlapsupported · undirected From January 2023 High confidence

The joint LockBit advisory reports that LockBit Green incorporated Conti ransomware source code. Code reuse is not evidence that the operations shared leadership.

  • CISA's LockBit evolution table records the January 2023 arrival of LockBit Green incorporating Conti source code.
 CISA, FBI, MS-ISAC, and international partners
Black Bastaoperation Shared operatorssuspected · undirected From April 2022 Moderate confidence

MITRE records researchers' assessment that Black Basta operators could include current or former Conti members. “Could include” is not treated as confirmed membership or succession.

  • MITRE's Black Basta software entry summarizes similarities in tactics, leak sites, payment sites, and negotiations and preserves the researchers' conditional assessment.
 MITRE ATT&CK

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

  • Shared operators with Black Basta — Moderate confidence

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. Understanding Ransomware Threat Actors: LockBitCISA, FBI, MS-ISAC, and international partners · government advisory · primary authoritative
  2. Conti RansomwareCISA, FBI, NSA, and U.S. Secret Service · government advisory · primary authoritative
  3. Conti, Software S0575MITRE ATT&CK · MITRE ATTACK · authoritative secondary
  4. Black Basta, Software S1070MITRE ATT&CK · MITRE ATTACK · authoritative secondary
  5. Multiple Foreign Nationals Charged in Connection with Conti Ransomware and Trickbot Malware ConspiraciesU.S. Department of Justice, Middle District of Tennessee · law enforcement · primary authoritative

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Conti notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Conti. Its 4 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Conti records

Collection: 32 records · 1,709 messages

Conti negotiation record collection
Participants Source Archive status
20211217 27 Conti, Victim JSON Indexed
20211205 63 Conti, Victim JSON Indexed
20211112 32 Conti, Victim JSON Indexed
20211108 32 Conti, Victim JSON Indexed
20210923 14 Conti, Victim JSON Indexed
20210904 17 Conti, Victim JSON Indexed
20210902 43 Conti, Victim JSON Indexed
20210820 50 Conti, Victim JSON Indexed
20210812 46 Conti, Victim JSON Indexed
20210805 47 Conti, Victim JSON Indexed
20210715 10 Conti, Victim JSON Indexed
20210708 25 Conti, Victim JSON Indexed
20210628 34 Conti, Victim JSON Indexed
20210611 48 Conti, Victim JSON Indexed
20210602 81 Conti, Victim JSON Indexed
20210520 101 Conti, Victim JSON Indexed
20210517 69 Conti, Victim JSON Indexed
20210517 56 Conti, Victim JSON Indexed
20210513 78 Conti, Victim JSON Indexed
20210428 13 Conti, Victim JSON Indexed
20210426 12 Conti, Victim JSON Indexed
20210316 63 Conti, Victim JSON Indexed
20210315 49 Conti, Victim JSON Indexed
20210305 45 Conti, Victim JSON Indexed
20210219 12 Conti, Victim JSON Indexed
20210126 9 Conti, Victim JSON Indexed
20210107 139 Conti, Victim JSON Indexed
20201230 146 Conti, Victim JSON Indexed
20201121 6 Conti, Victim JSON Indexed
20201109 255 Conti, Victim JSON Indexed
20201019 9 Conti, Victim JSON Indexed
20201017 78 Conti, Victim JSON Indexed