Monti

A ransomware operation first observed in 2022 whose encryptors initially borrowed heavily from leaked Conti code. Later variants diverged, and the group continued targeting Windows and Linux/ESXi environments with data theft and encryption for extortion.