MontiMalware
A ransomware, derived from the leaked Conti source code.From MISP Galaxy
Last reported 7 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1027.002Software Packing
“T1027.002”
- T1027.005Indicator Removal from Tools
“T1027.005”
- T1027.009Embedded Payloads
“T1027.009”
- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts: Logon Script (Windows)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
EDR killers explicados: Más allá de los drivers“Detectamos uno de los EDR killers de BlackSnufkin, TfSysMon-Killer, desplegado durante un ataque de ransomware Monti en febrero de 2025; la variante desplegada era idéntica en cuanto a funcionalidad, pero fue reimplementada de Rust a C++, probablemente para alinearse con o…”
-
EDR killers explained: Beyond the drivers“We detected one of BlackSnufkin’s EDR killers, TfSysMon-Killer, deployed during a Monti ransomware attack in February 2025; the deployed variant was identical functionality-wise, but was reimplemented from Rust to C++, likely to align with other tools of the threat actor.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.