When Conti’s source code leaked in March 2022 following the group’s public support for Russia’s invasion of Ukraine, it became an open development kit for ransomware operators. Several groups forked it. MONTI is the most persistent of that cohort — active from June 2022 through 2026, targeting a consistent set of sectors, and continuing to operate without the elevated profile that groups like LockBit or Cl0p attract.
MONTI is not a headline group. It doesn’t announce major victims on its leak site with the frequency of RaaS platforms or claim attacks on critical infrastructure in ways that generate government responses. That relative obscurity has allowed it to operate with less scrutiny than the threat warrants.
Origins and the Conti Fork
MONTI’s origin is the Conti leak. In February 2022, a Ukrainian security researcher published internal Conti chat logs, and in March the source code for Conti’s encryptor and decryptor followed. The leak represented a complete blueprint: not just compiled tools but the actual codebase, which operators with sufficient technical capability could modify and deploy.
MONTI was among the earliest groups to weaponize the leaked code. Analysis of early MONTI samples showed near-identical code to Conti v3, with modifications including updated ransom note content, different configuration defaults, and changes to the hardcoded command-and-control infrastructure. The name itself is a riff on Conti — changing the C to M.
Unlike Black Basta, which also forked Conti code around the same period, MONTI did not rapidly develop into a sophisticated RaaS operation with a large affiliate network. It operates more modestly, with a smaller victim count per month than the top-tier groups, but with consistent ongoing activity.
Linux Variant: VMware ESXi Targeting
MONTI’s Linux encryptor targets VMware ESXi servers — the hypervisor platform that hosts virtual machines across enterprise environments. Compromising an ESXi host encrypts all VMs running on it simultaneously, maximizing impact per compromised host.
The MONTI ESXi variant uses the locker utility approach common to ESXi-targeting ransomware: it iterates over running VMs, sends shutdown commands, and encrypts the associated virtual disk files (.vmdk, .vmx, .vmem, .vswp). ESXi administration is typically done through the VMware vCenter management console or direct SSH access to the hypervisor, and MONTI’s Linux encryptor is deployed via SSH after obtaining administrative credentials.
In 2023, Trend Micro researchers identified a significant evolution in MONTI’s Linux variant: the group shifted its encryptor from the original Conti-based code to a new encryptor based on Babuk’s leaked Linux/ESXi ransomware code. Babuk’s ESXi encryptor uses a different cryptographic approach than Conti’s, suggesting MONTI operators were actively maintaining and improving their toolset rather than running static forked code. The Babuk-based variant also introduced changes to the file extension appended during encryption and the ransom note format.
Windows Variant and Attack Chain
The Windows variant retains more similarity to the original Conti code base. MONTI uses it against Windows-based endpoints and servers in environments where ESXi is not the primary target.
Documented attack chains follow a pattern consistent with post-Conti ransomware groups:
Initial access via exposed RDP, compromised VPN credentials, or exploitation of internet-facing applications. MONTI has been observed exploiting vulnerabilities in remote access products, consistent with the broader trend of ransomware operators targeting perimeter devices.
Persistence and privilege escalation using common post-exploitation frameworks. Cobalt Strike has appeared in MONTI-attributed incidents, though the group has also used open-source alternatives. Lateral movement via PsExec and Windows Management Instrumentation follows privilege escalation.
Data exfiltration before encryption. MONTI operates a double extortion model with a leak site on Tor. Sensitive data — patient records, legal documents, employee PII, financial data — is exfiltrated before encryption. Threatened publication on the leak site is the leverage mechanism for ransom negotiations in cases where encrypted-data recovery alone might not motivate payment.
Deployment via Group Policy. In domain-joined environments, MONTI has used Group Policy Objects to deploy the encryptor to large numbers of endpoints simultaneously. This is the same GPO abuse technique documented in Conti’s original playbook.
Sectors and Targeting
MONTI’s sector targeting has remained consistent since 2022: healthcare, higher education, local government, and legal services. These sectors share characteristics that make them recurring ransomware targets — large volumes of sensitive regulated data that increases leverage for double extortion, operational dependency on affected systems that creates pressure to restore quickly, and security programs that are typically under-resourced relative to the attack surface.
Healthcare incidents attributable to MONTI include hospital systems and healthcare providers in the US and Europe. The targeting of healthcare is notable given the legal exposure it creates for operators under US law (HHS has specific guidance and FBI investigative priorities around healthcare ransomware), but MONTI has continued targeting this sector without apparent modification.
The legal sector targeting is consistent with the group’s interest in high-value sensitive documents. Law firm data contains client privileged communications, M&A deal information, litigation strategy, and other content that has significant value both for ransom leverage and potential sale.
Leak Site and Operations
MONTI operates a Tor-hosted leak site that publishes victim names and, in non-paying cases, exfiltrated data. The site is not as sophisticated as those operated by major RaaS platforms — it lacks the affiliate-facing backend infrastructure, dynamic auction mechanisms, and media relations capabilities of groups like Cl0p or RansomHub. MONTI appears to be a smaller operation with a relatively stable operator base rather than a broad affiliate network.
Victim publication on the site is used as a negotiating mechanism: proof that exfiltration occurred, accompanied by a countdown to full publication, is intended to create urgency for payment. This is standard double extortion practice.
Indicators and Detection
MONTI ransomware creates files with a .MONTI extension on encrypted files in earlier variants. The Babuk-based ESXi variant has used different extensions. Ransom notes are dropped as text files in encrypted directories.
Network indicators associated with MONTI incidents have included:
- Cobalt Strike infrastructure with typical team server TLS certificate characteristics
- Rclone or similar cloud sync tools used for pre-encryption data exfiltration
- WinSCP or FileZilla in exfiltration operations
- AnyDesk or other remote management tools installed for persistent remote access
On ESXi hosts, SSH access from unexpected IP addresses followed by the creation of new files in VM storage directories is an indicator of active encryptor deployment.
Behavioral detection on Windows endpoints: MONTI’s encryptor attempts to stop security services and backup processes before encryption begins. Process creation events showing net stop commands targeting security software, deletion of Volume Shadow Copies via vssadmin delete shadows /all, and bulk file extension changes are the standard ransomware behavioral signatures that apply here.
Outlook
MONTI is not the most technically sophisticated group in the current ransomware landscape, and it does not operate at the scale of RaaS platforms with large affiliate networks. What it has demonstrated is durability. Four-plus years of continuous operation, active toolset maintenance (the Babuk-based ESXi variant shift), and consistent sector targeting suggest a stable operator group that has found a sustainable model.
For defenders in healthcare, education, government, and legal services: MONTI is a persistent threat worth tracking. The group’s techniques are well-documented and the standard ransomware defense posture — reduced internet-exposed attack surface, MFA everywhere, monitored privileged access, ESXi network segmentation, offline backups — addresses the attack chain. The risk isn’t sophistication; it’s consistency.