Australian ACSC warns of Conti ransomware attacks against local orgs

The Australian Cyber Security Centre (ACSC) warns of Conti ransomware attacks again multiple Australian organizations.

The Australian Cyber Security Centre (ACSC) warns of Conti ransomware attacks against multiple Australian organizations from various sectors since November.

“The ACSC is aware of multiple instances of Australian organisations that have been impacted by Conti ransomware in November and December 2021. This activity has happened across multiple sectors. Victims have received demands for ransom payments. In addition to the encryption of data and subsequent impact to organisations’ ability to operate as usual, victims have had data stolen during incidents published by the ransomware actors, including Personally Identifiable Information (PII).” reads the advisory published by the cybersecurity agency.

Conti operators run a private Ransomware-as-a-Service (RaaS), the malware appeared in the threat landscape at the end of December 2019 and was distributed through TrickBot infections. Experts speculate the operators are members of a Russia-based cybercrime group known as Wizard Spider.

Since August 2020, the group has launched its leak site to threaten its victim to release the stolen data. Conti operators claimed to have already compromised at least 500 organisations worldwide.

Recently the Conti gang hit the attack on the Australian energy CS Energy and threaten to leak the stolen files.

The ACSC also published a ransomware profile for the Conti gang that contains information about the operations of the group, including mitigations.

“The ACSC has observed an increase in domestic and global Conti activity throughout 2021. Conti affiliates are known to implement the ‘double extortion’ technique by uploading exfiltrated victim data to their dedicated leak site (DLS) and threatening to release victim data in tranches if the ransom is not paid.” reads the ransomware profile.

“The threat actors involved in the deployment of the Conti ransomware frequently change attack patterns, and quickly take advantage of newly disclosed vulnerabilities to compromise and operate within networks before network owners are able to apply patches or mitigations.”

In September, CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) also warned of an increased number of Conti gang attacks against US organizations.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Conti)

[adrotate banner=”5″]

[adrotate banner=”13″]