How do you defend against Conti, DarkSide, REvil and similar ransomware?

You defend against Conti, DarkSide, REvil and later ransomware the same way, because they share entry points and goals. Close the common initial access routes, keep tested offline backups, limit lateral movement, and prepare an incident response plan. CISA's #StopRansomware Guide organizes prevention around exactly those routes.

Why defend against the method, not the name?

Ransomware families come and go as groups split, rebrand or are disrupted. CISA and the FBI described DarkSide as ransomware-as-a-service: the developers receive a share of proceeds from the criminals, called affiliates, who deploy it. That model means the same attack methods can be used by many people under different names, and a defense built around one name ages quickly.

A defense built around the methods lasts. CISA's guide says prevention best practices are grouped by the common initial access vectors used by ransomware and data extortion actors, so that is the map to follow.

What are the entry points?

The #StopRansomware Guide lists these initial access vectors:

1. Internet-facing vulnerabilities and misconfigurations. Unpatched or poorly configured systems reachable from the internet.
2. Compromised credentials. Stolen or guessed logins, often used on remote access.
3. Phishing. Malicious email that tricks a user into acting.
4. Precursor malware infection. Earlier malware that opens the door for ransomware.
5. Advanced forms of social engineering. Beyond basic phishing.
6. Third parties and managed service providers. Access through a supplier.

The DarkSide advisory matches the pattern. It says, citing open-source reporting, that DarkSide actors have been observed gaining access through phishing and by exploiting remotely accessible accounts and systems and virtual desktop infrastructure, and have used RDP to maintain persistence.

What does the guide recommend for each?

For internet-facing weaknesses: audit for systems using RDP, close unused RDP ports, enforce account lockouts, apply MFA and log login attempts. Update VPNs and network devices with the latest patches, and implement MFA on all VPN connections. Disable SMB version 1.

For credentials: require MFA, and CISA discusses phishing-resistant and passwordless options. Password managers help, with their own MFA enabled.

For phishing: use a DMARC policy and verification, strong spam filters and training that includes how to report suspicious messages.

For precursor malware: CISA recommends centrally managed antivirus that can detect both precursor malware and ransomware, and tools configured to escalate warnings to security staff.

For third parties: if a supplier or managed service provider maintains your backups or security, make sure they follow the same practices, and write your requirements into the contract. CISA also advises mitigating malicious use of remote access and remote monitoring and management tools.

How do you survive an attack that still gets through?

CISA says to maintain offline, encrypted backups and to test them, because many variants try to find and delete or encrypt accessible backups. Keep golden images of critical systems, and use infrastructure as code with offline copies of the templates so cloud resources can be redeployed quickly.

Then limit the spread. The guide says network segmentation can help contain an intrusion and prevent or limit lateral movement. The DarkSide advisory urged strong segmentation between IT and OT networks, regular testing of manual controls, and backups that are tested and isolated from network connections.

What should the response plan cover?

The second part of the guide is a response checklist. A few points to build into your plan:

• Report to CISA, your local FBI field office, the FBI Internet Crime Complaint Center or the US Secret Service, and consider asking for help. If you are outside the United States, use your national authority.
• Isolate systems in a coordinated way, and use out-of-band communication such as phone calls, so attackers do not learn you have found them and rush to spread or deploy.
• Look for precursor dropper malware before restoring. CISA notes a ransomware event may be evidence of an earlier unresolved compromise, and that restoring from backup without finding the dropper can bring the attackers back.
• Look for attempts to impair recovery, such as misuse of built-in Windows tools to delete shadow copies.
• Consult law enforcement about possible decryptors before assuming data is gone.

Constructed example. A distribution company gets hit on a Friday. Because the backup server is isolated, they can restore. Because they rehearsed, the first call goes to the response lead, not to the person who found the note. They isolate the file servers and call the incident hotline from personal phones. They restore from clean images only after finding a leftover remote access tool on one server. The attackers do not get a second chance.

How to check or apply this

1. Inventory internet-facing systems and patch or remove them, starting with VPNs and remote access.
2. Require MFA on all remote access and administrator accounts.
3. Turn on DMARC and email filtering, and give staff an easy reporting path.
4. Hold an offline, encrypted backup, and time a restore of a critical system.
5. Segment the network so servers, backups and administrative tools are not reachable from every laptop.
6. Review third parties that hold backups, remote access or management tools.
7. Write the response plan, with out-of-band contacts, and run a tabletop each year.

Quick check

Sources

• CISA #StopRansomware Guide
• CISA and FBI advisory AA21-131A, DarkSide Ransomware

Last reviewed: 18 October 2026.