Despite Leaks, Conti Ransomware Attacks Persist

ThreatLabz details a January 2022 update to the Conti ransomware family that adds Safe Mode-based encryption (via -safeboot, -user, -pass), automatic Safe Mode login through registry manipulation, network-enabled Safe Mode to reach shares, per-file ChaCha symmetric keys protected by a hardcoded 4096-bit RSA public key, API hashing change (Murmur3) for evasion, randomized mixed-case encrypted file extensions, a wallpaper payload, and a streamlined victim portal; the report includes SHA256 IoCs and Zscaler detection names.