Over the past several weeks, activity from the Monti ransomware organization appears to have increased alongside the unveiling of their new ransomware encryptor specifically for Linux systems. Monti, believed to be a rebranded organization of the Conti Ransomware group, has been operational since June 2023 and is well known for their striking similarities to Conti. Aside from their similar group names, attack tactics and techniques, and ransomware source code, Monti primarily targets entities operating on Linux systems within the healthcare, legal, manufacturing, and government industries. The group has been on a brief hiatus for around two (2) months but have come back in force with a new ransomware campaign and publication of compromised entities’ data on their leak site. In terms of the Linux ransomware variant, around 29% of the code was reused from previous Conti ransomware variants and now has the capabilities to whitelist specific machines from encryption, encrypt systems with AES-256-CTR cryptographic encryption rather than Salsa20, and adjust encryption style based on file size. Alongside these capabilities come changes to Monti’s ransom note and functions to gather system information from targeted endpoints. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.