The Continuity of Conti

## Executive summary The report examines how the Conti ransomware operation persisted and splintered after internal leaks in 2022, documenting links between Conti and successor or affiliated ransomware campaigns (Quantum, Black Basta, Royal), associated malware families (BumbleBee, BazarLoader, IcedID, Qakbot, Emotet), and affiliate/IAB activity that has enabled high-impact extortion operations against multiple victims including a national incident in Costa Rica.