Monti

Inactive
Monti is a ransomware group first observed in June 2022 that initially copied nearly all of Conti's leaked source code, pivoting to target government, legal, and healthcare entities, later releasing a new Linux variant in 2023 with significantly less Conti code similarity, and experimenting with an affiliate model.
110 Victims
Dec 7, 2022 First Discovered
May 7, 2025 Last Discovered
497 Days Inactive
0% Infostealer
0/2 Sites Online
Known Locations (2)
MONTI - Leaks site
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion
404 Not Found
4s4lnfeujzo67fy2jebz2dxskez2gsqj2jeb35m75ktufxensdicqxad.onion
Tools Used
CredentialTheft
Mimikatz, Veeam-Get-Creds
DefenseEvasion
Avast Anti-Rootkit driver, GMER
DiscoveryEnum
SoftPerfect NetScan
Exfiltration
MEGA, PSCP, WinSCP
RMM-Tools
Action1, AnyDesk
Intelligence
Victims (110)

Detailed victim list temporarily unavailable

This group has 110 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.