How can organisations defend against Conti?

How Conti Typically Breaks Defences

Conti is most dangerous when defenders treat it as a single malware family instead of a fast-moving intrusion pattern. The practical problem is not just encryption at the end, but the sequence that leads there: initial access, credential theft, privilege escalation, discovery, lateral movement, and then disruptive encryption or extortion pressure.

That means the first defensive objective is to make each stage harder to complete. Phishing-resistant authentication reduces the value of stolen passwords, rapid patching closes common entry points, and network segmentation limits how far one compromised host can reach. When those controls work together, they reduce the attacker’s ability to turn one foothold into a full-domain incident.

Organisations should also treat remote administration and privileged access as high-value paths. If admin credentials are broadly available, reused, or left standing for long periods, Conti-style operations can move faster than many teams expect. Offline backups matter because they preserve recovery options when both primary systems and online backup targets are exposed.

Where Containment Usually Fails

The biggest failure mode is assuming the breach is contained because the initial infected host is known. Ransomware crews often use legitimate tools, especially remote access tooling and built-in administrative protocols, so activity can blend into normal operations until encryption starts or data access patterns change. Ransomware Groups Guide is useful background for understanding how ransomware crews reuse common techniques across campaigns.

Another common gap is delayed visibility into privilege abuse. Once attackers obtain a privileged session, they can disable protections, spread through SMB shares, stage payloads, and prepare for mass encryption without needing to invent noisy new techniques. The defender’s problem is often not one missing alert, but insufficient detection of the sequence of events that signals a campaign is progressing.

Recovery also fails when backups are not operationally tested. A backup that exists on paper but cannot be restored quickly, cleanly, and at the right scope does not meaningfully reduce ransomware impact. The same is true for segmentation that is documented but not enforced between user networks, servers, and administrative systems.

What to Verify Before You Trust the Control

Defenders should verify that phishing-resistant MFA is actually enforced on remote access, privileged access, and any externally reachable management surface. They should also confirm that emergency or service accounts are not bypassing the normal authentication path. For a control set built around strong authentication and access restriction, NIST SP 800-63 Digital Identity Guidelines is a strong reference point for phishing-resistant authentication.

Segmentation should be tested by trying to move laterally under realistic compromise assumptions, not by reviewing network diagrams alone. If an attacker can still reach file shares, administrative ports, or backup systems from a compromised workstation segment, then the environment is only partially defended. NIST SP 800-207 Zero Trust Architecture is relevant where the control objective is to reduce implicit trust and constrain lateral reach.

Backup validation should include restoration, not just retention. Teams should know how long a full restore takes, whether critical data can be recovered without reintroducing malware, and whether offline copies are truly isolated from the production trust zone.

Risk and Threat Considerations

Conti-style intrusions are risky because they compress time. Once the adversary has initial access and usable privilege, the window to stop spread can be very short, especially in environments with flat networks, shared administrative credentials, and weak monitoring of remote access activity.

Failure mechanism: Attackers exploit exposed services or stolen credentials, then use legitimate admin tools, SMB movement, and privilege escalation to reach more systems before encryption begins.

Impact: The result can be rapid encryption across multiple systems, loss of availability, backup compromise, and longer recovery if the organisation cannot restore cleanly from isolated copies.

Practitioner Guidance

What to prioritise: Focus first on the paths that turn a single foothold into enterprise-wide disruption: remote access, privileged credentials, east-west movement, and backup reachability. If those are still broadly trusted, ransomware resistance is weaker than it appears.

What to verify: Confirm that restore tests are recent, privileged accounts are tightly scoped, and lateral movement is actually blocked rather than merely reviewed. Also verify that security monitoring can distinguish legitimate admin activity from unusual spikes in remote tooling, SMB traffic, and encryption-like file operations.

Decision rule: If a control only slows Conti but does not reduce blast radius, it is incomplete. A mature defence combines prevention, detection, and recoverability so that the attacker must succeed across several stages, not just the first one.

Practitioner takeaway: The most effective Conti defence is not a single anti-ransomware product, but a set of controls that deny fast privilege gain, constrain spread, and preserve a trustworthy recovery path.

Related resources from NHI Mgmt Group

• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?