From the Labs: YARA Rule for Detecting Conti

This report profiles the Conti ransomware-as-a-service operation, outlining its prevalence, double-extortion extortion methodology, common initial access vectors (spear-phishing, stolen/weak RDP credentials), post-compromise tooling (Mimikatz, TrickBot, Cobalt Strike), and intrusion behaviors; it also provides a ReversingLabs YARA rule and guidance for detecting Conti in customer environments.