Description Summary
Conti-leak variant; decryptor released Mar 2023 for the original; now a data-theft brand (Meow Leaks) that tapered off by Oct 2025.
Threat Actor
Built on leaked Conti code; original strain decryptable; current activity is data theft/extortion.
Technical Indicators
Encryption Extension
.meow
Encryption Algorithm
ChaCha20 + RSA-4096
Ransom Note Name
Contact via email / Telegram (meow2022, meow123)
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
August 2022 (Conti-leak variant)
Last Seen
Declining (tapered off by Oct 2025)
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |