Ransomware Group
Monti
Monti is a ransomware group first observed in June 2022 that initially copied nearly all of Conti's leaked source code, pivoting to target government, legal, and healthcare entities, later releasing a new Linux variant in 2023 with significantly less Conti code similarity, and experimenting with an affiliate model.
Known victims110
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
- Veeam-Get-Creds
DefenseEvasion
- Avast Anti-Rootkit driver
- GMER
DiscoveryEnum
- SoftPerfect NetScan
Exfiltration
- MEGA
- PSCP
- WinSCP
RMM-Tools
- Action1
- AnyDesk
Known infrastructure
The following Tor hidden services have been associated with this group:
MONTI - Leaks site404 Not Found
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Monti’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request