Talos Analysis of Leaked Conti Ransomware Playbook Reveals Tools and Tactics
Summary
Talos translated a leaked Conti playbook and analyzed its tools and tactics, including Active Directory reconnaissance and credential theft. The detailed instructions could lower the barrier for less-experienced affiliates to carry out ransomware attacks.
Key points
- The documents were allegedly leaked by a disgruntled Conti affiliate and include a Cobalt Strike manual.
- The playbook describes hunting for administrator access through Active Directory enumeration, Windows utilities, and open-source information.
- Listed tools include Cobalt Strike, AdFind, Armitage, SharpView, SharpChrome, and SeatBelt.
- Talos says the instructions are detailed enough to help less-experienced operators conduct damaging ransomware attacks.
- The playbook describes disabling Windows Defender and using GMER; Talos says monitoring GMER execution may help identify precursor activity.
- The documents include instructions for exploiting Zerologon (CVE-2020-1472), which Talos had also observed in a previous Ryuk engagement.
Article Details
- Attack Vectors
- Conti playbook instructions describe hunting for administrator access on victim networks by enumerating users and Active Directory access, and using OSINT such as LinkedIn to identify privileged roles.
- The playbook includes instructions for exploiting CVE-2020-1472 (Zerologon) through Cobalt Strike; Talos separately reports observing Ryuk operators use the vulnerability to impersonate a domain controller.
- Talos reports that ransomware actors used GMER to identify security protections and antivirus software and to stop or remove them.
- The playbook describes using Cobalt Strike and tools including Armitage, SharpView, SharpChrome, and SeatBelt in attack activity.
- Defensive Notes
- Monitor for GMER execution as potential precursor activity to ransomware; Talos notes hash-based tracking may be effective because GMER has not been updated in several years.
- Maintain detection logic and compensating controls for the described network discovery, Active Directory hunting, and security-tool disabling behaviors.
MITRE ATT&CK
T1069.002 · Domain GroupsThe playbook describes using whoami to enumerate the groups a user belongs to.T1087.002 · Domain AccountThe playbook describes using Net and AdFind to enumerate users and accounts in Active Directory.T1210 · Exploitation of Remote ServicesThe playbook includes instructions for exploiting CVE-2020-1472 (Zerologon) through Cobalt Strike to impersonate a domain controller.T1562.001 · Disable or Modify ToolsTalos reports ransomware operators disabling Windows Defender real-time monitoring, including instructions in the playbook to disable it manually and an alternative use of GMER to stop or remove protections.T1593 · Search Open Websites/DomainsThe playbook authors describe using LinkedIn to identify users and roles with privileged access.
CVE
People
Threat Actors
Malware
Vendors
Products
Active Directorytargeting. Of note, the only "geographical" mention by the adversaries was the mention of U.S./EU active directory (AD) structures. Their instructions, which are meticulous and easy to follow, also demonstrate thatCobalt Strikespeakers that translated these documents in their entirety into English. We also translated a Cobalt Strike manual that the authors referenced while creating their playbook.LinkedInusers with access to Active Directory, and even OSINT, including the use of social media sites like LinkedIn to identify roles and users with privileged access. They note that this hunting process is particularlyPowerShellSharpView is a .NET port of PowerView, one of many tools contained within the PowerSploit offensive PowerShell toolkit.Telegramcase. The LockBit operator also told us that ransomware actors use various channels on the messaging app Telegram to stay on top of the latest exploits and attack trends. A look into a list of Telegram channels deemedWindows DefenderIn many ransomware engagements, CTIR typically observes the adversary using PowerShell to disable Windows Defender real-time monitoring. This is in contrast to the adversary's instructions to manually disable
Tools
AdFindaccess once on the victim network. They use commands such as Net to list users and tools like AdFind to enumerate users with access to Active Directory, and even OSINT, including the use of social mediaArmitageThese actors also appear to be using two tools — Armitage and SharpView — that are not commonly seen in Cisco Talos Incident Response (CTIR) ransomware engagements. Armitage is a red-team toolkit built on the MetasploitGMERthe only tool mentioned by these adversaries to disable Windows Defender — the adversaries suggest using GMER as an alternative. GMER is a tool CTIR has observed across a few ransomware engagements, including atNetlist several ways to hunt for administrator access once on the victim network. They use commands such as Net to list users and tools like AdFind to enumerate users with access to Active Directory, and even OSINT,PowerSploitscans, and more, while SharpView is a .NET port of PowerView, one of many tools contained within the PowerSploit offensive PowerShell toolkit.PowerViewframework that enables the user to launch exploits, scans, and more, while SharpView is a .NET port of PowerView, one of many tools contained within the PowerSploit offensive PowerShell toolkit.SeatBeltSharpChrome and SeatBelt — two other tools we have not seen used in CTIR ransomware engagements — were also used for credential-dumping. SharpChrome is a Chrome-specific implementation of SharpDPAPI and attempts toSharpChromeSharpChrome and SeatBelt — two other tools we have not seen used in CTIR ransomware engagements — were also used for credential-dumping. SharpChrome is a Chrome-specific implementation of SharpDPAPI and attempts toSharpDPAPIengagements — were also used for credential-dumping. SharpChrome is a Chrome-specific implementation of SharpDPAPI and attempts to decrypt logins and cookies. SeatBelt is a project written in C# that collects systemSharpViewThese actors also appear to be using two tools — Armitage and SharpView — that are not commonly seen in Cisco Talos Incident Response (CTIR) ransomware engagements. Armitage is a red-team toolkit built on the Metasploitwhoamiand discovery, such as the use of ADFind to query for information on Active Directory (AD), and whoami to enumerate groups the user is a member of.