Conti ransomware has been used in more than 400 attacks vs. U.S. and international organizations, according to a warning from the FBI and CISA (Cybersecurity and Infrastructure Security Agency).
Moreover, some of the Conti ransomware attacks exploit legitimate remote monitoring and management (RMM) and remote desktop software as backdoors to maintain persistence on victim networks, the warning states.
That's a particularly troubling news for MSPs and MSSPs, thousands of which depend heavily on RMM and remote desktop software to remotely manage and troubleshoot end-customer systems.
Concerns about Conti ransomware threat actors leveraging legitimate RMM software have swirled since at least August 2021 -- when a leaked Conti ransomware playbook that mentioned RMM software surfaced on the Internet.
How MSPs and MSSPs Can Prevent Conti Ransomware Attacks
To mitigate the risk of Conti ransomware attacks, the FBI and CISA say MSSPs and MSPs should take these seven steps:
In terms of endpoint security, multiple software companies proclaim that their endpoint protection tools prevent Conti ransomware attacks. Examples include this BlackBerry statement from May 2021.
How MSPs and MSSPs Can Respond to and Recover From Ransomware Attacks
If a ransomware incident occurs, then the CISA, FBI and NSA recommend the following four actions:
