Notorious Russian Gang and Affiliates Increase Ransomware Attacks Against Europe

For several years, eSentire’s Threat Response Unit (TRU) has been keeping close tabs on the Conti group’s illicit activities. Despite Conti shutting down operations as a formal entity, two Conti affiliate groups, BlackByte and Black Basta, emerged on the ransomware scene between July 2021 and April 2022.

Between the end of February and mid-July 2022, TRU has tracked 81 victim organisations listed on the BlackByte and Black Basta data leak sites; 41% of their victims are based in Europe and many are part of critical infrastructure sectors including energy, government, transportation, pharmaceuticals, facilities, food, and education.

As evidenced by the cyberattacks and the damage caused by the Black Basta and BlackByte affiliates, the Conti threat is alive and well, and is as destructive as it has always been.

Download this report for:

• A review of notable ransomware attacks deployed by BlackByte and Black Basta and the subsequent impact on victim organisations
• An analysis of Conti’s history, including how the ransomware group has evolved and whether they truly shut down their operations
• Insights and recommendations from TRU on how to defend your organisation from this cyber threat