{Update September 2021}: The Conti group that started trending early this year, is still going strong. In a newly disclosed data breach from June 2021, SAC Wireless, a US-based Nokia subsidiary, reported 250 GB of data stolen and encrypted systems.


{Update August 2021}: In a recent development in early August 2021, a disgruntled Conti RaaS affiliate leaked some of the gang’s core training material, as he was unsatisfied with his cut for a ransomware attack. The publicly available data includes Cobalt Strike C2 IP addresses and ransomware attack tools and training details, all the more reason for organizations to watch out for all possible attack vectors weaponized by the Conti group.


The Conti group is associated with three vulnerabilities. If these had taken precedence in the CVE patching priority, the series of Conti attacks could have been avoided.

CVE-2020-0796 and CVE-2018-13379 were warned against in CSW’s Ransomware Reports published in February and May 2021.

Let us take a look at the different recent incidents in which the Conti group has been involved.

Conti Ransomware Attacks

The Ireland HSE incident shook the health industry, closely following in the wake of the Oil industry’s Colonial Pipeline attack; IT systems had to be shut down, leading to chaos in rendering regular health services. Exagrid paid a $2.6M ransom in the form of 50.75 Bitcoins for a decryption tool and to prevent data from being leaked. In more recent updates in the last week of June 2021, Conti claimed responsibility for an attack on the city of Tulsa in early May, leaking over 18,000 city files on the Dark Web. Three Canadian companies – an Internet provider and an engineering firm, both from Ontario, and a Quebec-based insurance broker – have also fallen victim to the group, according to Conti’s website.

   Conti – A Cheat Sheet

     We analyzed three CVEs being exploited by the Conti group – CVE-2020-0796,
CVE-2018-13374, CVE-2018-13379, and here is our analysis about them –

  • CVE-2020-0796 is a critical RCE/PE vulnerability, with a severity score of 10. This vulnerability also goes by the names CoronaBlue and SMBGhost, and was one of the top exploited vulnerabilities of 2020.
  • CVE-2018-13379 is a critical RCE vulnerability that allows for unauthenticated attacks, and has a severity score of 9.8.

  • CVE-2018-13374 is a high-rated vulnerability, with a severity score of 8.8 and can be exploited to compromise web applications.

  • CWE Weakness Categories

    • CVE-2020-0796 is categorised under a weakness leading to improper input validation, CWE-20

    • CVE-2018-13379 falls under a weakness leading to improper limitation of a pathname to a restricted directory, CWE-22

    • CVE-2018-13374 belongs to CWE-732 that leads to assignment of incorrect permissions for critical resources

  • CVE-2020-0796 is present in two Microsoft products – Windows 10 and Windows Server 2016, while the other two exist in Fortinet’s FortiOS.

  • A patch for CVE-2020-0796 has been available since March 2020, while vendors recommend upgrading to the latest version of FortiOS for the other two vulnerabilities.


Vulnerabilities used by Conti Ransomware

It is widely believed that Russia’s Wizard Spider Advanced Persistent Threat (APT) group uses the Conti ransomware in its attacks.

Global Exposure

A Shodan analysis of CVE-2020-0796 brings up over 75,000 deployments, mainly focused in Taiwan and Japan. Windows 10 Home is the most widely used OS susceptible to CVE-2020-0796 exploits.



There are over 60,000 deployments of FortiOS worldwide, according to Shodan, with the US ranking first on the list.


Attack Methodology

Looking at multiple attacks involving Conti ransomware, we have understood the following to be their overall attack methodology.

  1. Scout for weak entry points in devices and infect them with IcedID payload, followed by BazarLoader malware.

  2. Use batch files to disable security tools through the created backdoor.

  3. Deploy Cobalt Strike beacon to gather confidential details

  4. Scan to identify open ports

  5. Utilize a combination of Remote Desktop Protocol (RDP), PsExec and Server Message Block (SMB) to worm its way laterally within the network

  6. Exfiltrate data to cloud storage through command line tools like RClone

  7. Stealthily deploy Cobalt Strike beacon to attached devices

  8. Execute malicious code in memory across all active systems

  9. Delete shadow copy using Windows Management Instrumentation (WMI)

  10.  Ransomware continues ploughing through until detected

Attack Methodology - Conti Ransomware

Coincidentally, on June 1, 2021, the FBI sent out a warning regarding New Zealand based Mega cloud storage being used by ransomware groups like Conti,  for data storage.


Indicators of Compromise

SHA 256:















MITRE Att&ck Map Conti Ransomware

A thorough ransomware analysis is the need of the hour

The vulnerabilities CVE-2020-0796 and CVE-2018-13379 are currently trending, although they were discovered more than a year back. This is a clear indication of the importance of patching older vulnerabilities and not just the newly discovered high-severity ones. In fact, as highlighted in CSW’s Ransomware Report, vulnerabilities that were discovered in 2020 and earlier accounted for 97% of the total vulnerability count (260) as of March 2021.

The recent series of attacks is an example of how attackers might be taking it slow, waiting for bigger opportunities leading to crippling disruption. Adopting a risk-based approach and prioritizing critical vulnerabilities based on threat context is the need of the hour.

Reach out to CSW for assistance with vulnerability analysis and prioritization.

Share This Post On