Conti Recon And Initial Access

Stage a phishing email in user's Documents directory then open it. Next, stage and launch a malicious PDF in user's Downloads directory. The malicious PDF creates a C:\Conti directory to stage and launch a Jambi agent.

TTP Tuesday: Conti (Release 1)

Recon and Initial Access

Theme Overview

We are kicking off a new theme this week focusing on Conti ransomware. We have released some Conti TTPs previously, but plan to expand it to include an entire adversary attack from beginning to end. The Conti theme will contain the following kill-chains:

1. Recon and Initial Access (Current Release)
2. Local and Remote Discovery
3. Gain privileges and persist
4. Move to remote systems
5. Data collection and exfiltration
6. Deploy ransomware

Recon and Initial Access

Conti is considered Ransomware-as-a-Service (RaaS) and has an elaborate chain of events from initial access to execution of the ransomware. For this week, we are focusing on the initial access. Conti tends to use three methods to gain initial access; spearphishing, weak RDP credentials, and search engine promoted application installs. We are specifically focusing on spearphishing to gain initial access. In this chain, we use Pneuma agent as a stager then open both a phishing email and malicious PDF which will execute Jambi as our Conti agent moving forward.

Watch a demonstration: Conti Recon & Initial Access

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator:
See the latest kill chain and TTP Releases:
See our open-source repositories:

Join our community


Read, watch, and listen

Listen to our Podcast:
Read our blog:
Watch our live streams:
Watch our pre-recorded content:

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Sam: wasupwithuman

Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator


Stage and execute Conti phishing email
Stage and launch Conti phishing payload
Stage and launch Jambi