Conti is a Russia-based ransomware-as-a-service (RaaS) operation that first emerged in December 2019 under the alias Wizard Spider, a group also known for the TrickBot banking trojan. This financially motivated threat actor quickly evolved from an initial malware strain into a highly prolific RaaS model, distinguishing itself through its rapid, multi-threaded encryption capabilities that made it faster than many contemporary ransomware variants. Conti was an early and prominent adopter of the double extortion tactic, involving both data encryption and exfiltration with threats of public release. The group's operational structure, while affiliate-based, sometimes varied from typical RaaS models by reportedly paying deployers a fixed wage rather than a commission. A critical turning point for Conti was its public declaration of support for Russia following the invasion of Ukraine in February 2022, which led to significant internal data leaks (ContiLeaks) and ultimately its official disbandment in May 2022, although many former members are believed to have transitioned to other ransomware operations.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.