The Playbook

Abstract This chapter examines the operational playbook that enabled Conti to become one of the most successful ransomware groups. By breaking down Conti’s tactics, techniques, and procedures into eleven interconnected stages, the chapter provides a detailed analysis of how the group executed its attacks. Conti’s process begins with broad reconnaissance, scanning for exploitable openings rather than meticulously selecting individual targets. Phishing emerges as their preferred initial access method, leveraging human vulnerabilities. Once inside a network, the group prioritizes situational awareness and privilege escalation, ensuring deep access and control. Conti identifies and exfiltrates high-value data before deploying encryption, setting the stage for ransom negotiations. Their use of cryptocurrency for payments and cash-out operations underscores a structured approach to sustaining their criminal enterprise. The chapter draws on internal Conti documentation providing rare insights into how the group standardized and refined its methods.