ransomware

Monti

dormantAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Monti RansomwareMONTI

Attribution

Financially motivated ransomware operation; no confirmed nation-state or named-group attribution. Widely assessed by vendors (Trend Micro, BlackBerry) as an independent actor that deliberately imitated the Conti ransomware brand and reused Conti's leaked source code. The 'Monti' name itself is a play on 'Conti'.

First seen

2022-06

Last active

2025-05-08

Motivation

Financial gain via data-encryption extortion and double-extortion data-leak pressure.

Attribution confidence

medium

MENA targeting

UAE

Sectors

Professional services

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE (Professional services sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Nemesis KittenactorTechnique overlap
BianLianactorTechnique overlap
SinobiactorTechnique overlap
Crypto24actorTechnique overlap
RansomHubactorTechnique overlap
WarlockactorTechnique overlap
LynxactorTechnique overlap
UNC215actorTechnique overlap
Devmanactor

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Monti's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

14 / 16

Mean robustness (of covered)

2.1

Useful?