--- title: 7 Steps to Help Defend Against Conti and PYSA Ransomware description: Follow these 7 helpful Tips for your organization to help defend against Conti and PYSA ransomware. image: https://www.bitlyft.com/hubfs/Shielf.jpeg --- [BitLyft](https://www.bitlyft.com) [![BitLyft](https://www.bitlyft.com/hubfs/raw_assets/public/bitlyft-2021-new/src/images/BLLogo.svg "BitLyft")](https://www.bitlyft.com) - Solutions - [BitLyft True MDR](https://www.bitlyft.com/agentic-mdr) - [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) - [Security Automation](https://www.bitlyft.com/security-automation) - [Security Operation Center (SOC)](https://www.bitlyft.com/security-operations-center-soc) - [SIEM Management](https://www.bitlyft.com/security-information-and-event-management-siem) - [Central Threat Intelligence](https://www.bitlyft.com/central-threat-intelligence) - [BitLyft AIR®](https://www.bitlyft.com/air) - Industries - [Banking](https://www.bitlyft.com/cybersecurity-for-banks) - [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) - [DoD (CMMC)](https://www.bitlyft.com/cmmc-cybersecurity-compliance) - [NIST 800 - 171](https://www.bitlyft.com/nist-800-171) - [Healthcare](https://www.bitlyft.com/healthcare-cybersecurity) - [Higher Education](https://www.bitlyft.com/higher-education-cybersecurity) - [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) - [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) - [Energy and Utilities](https://www.bitlyft.com/energy-utilities-cybersecurity) - [Pricing](https://www.bitlyft.com/agentic-managed-detection-response-pricing) - [Partners](https://www.bitlyft.com/partners) - Company - [About Us](https://www.bitlyft.com/about-us) - [Careers](https://www.bitlyft.com/careers) - [Contact Us](https://www.bitlyft.com/contact-us) - Resources - [Blog](https://www.bitlyft.com/resources) - [Case Studies](https://www.bitlyft.com/case-studies) - [Downloads](https://www.bitlyft.com/downloads) - [Glossary](https://www.bitlyft.com/glossary-of-terms) - [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) [![blue shield with circuit board](https://www.bitlyft.com/hs-fs/hubfs/Shielf.jpeg?height=225&name=Shielf.jpeg)](https://www.bitlyft.com/bitlyftnews/defend-against-conti-and-pysa-ransomware) # 7 Steps to Help Defend Against Conti and PYSA Ransomware [ransomware](https://www.bitlyft.com/bitlyftnews/tag/ransomware) , [Cyber Attacks](https://www.bitlyft.com/bitlyftnews/tag/cyber-attacks) [Jason Miller](https://www.bitlyft.com/bitlyftnews/author/jason-miller) | 11/4/2021 With the increase of recent activity from the Conti and PYSA ransomware, here are a few recommendations and reminders to ensure your organization minimizes its chances of a harmful breach. ## Tips for Protecting Against Conti and PYSA Ransomware 1. Ensure VPNs are configured to log the IP address and username of the person who is using a connection. 2. Ensure you have a strict system process on new account creation, with alerts if any accounts are created from outside that system, via VPN or remotely performed. 3. Enable script control blocking on your endpoint security solution. Scripts that are required for operations should be given exceptions. 4. Ensure that [MFA](https://www.bitlyft.com/resources/cybersecurity-101-how-to-use-multi-factor-authentication) is in place on **all** admin accounts, accounts that have domain admin level privileges, or elevated privileges. 5. It is recommended that all user accounts have MFA enabled, but if that is not possible, then at a minimum we advise the admin accounts. 6. Separate accounts for admin users to perform admin activity. These should be separate from standard user accounts performing standard work like email, web browsing, etc. 7. Lock down PowerShell to ONLY PowerShell scripts you know and have validated to be known good. 8. All other PowerShell scripts must be denied until you can verify and validate if they are good or malicious. 9. Backups: You must have known good backups of Domain Controllers, and all critical important servers, systems, and data. Please make sure you also have a second set of backups off-site, not connected to the local area network. The second set of backups must be remote, not through a VPN, 100% remote from the original source of backup data. These steps outlined above help you minimize the risk of getting attacked with fast moving malware or ransomware that can execute quickly through PowerShell scripts and other methods that are difficult to detect or stop. ![Author Profile Image](https://www.bitlyft.com/hs-fs/hubfs/Headshots/JasonRound.png?width=192&height=192&name=JasonRound.png) [Follow me on LinkedIn](https://www.linkedin.com/in/jasonmillerbitlyft/) [Follow me on Twitter](https://twitter.com/MillerJmiller) ## [Jason Miller](https://www.bitlyft.com/bitlyftnews/author/jason-miller) Jason Miller, Founder and CEO of BitLyft Cybersecurity, has dedicated his 20-year IT career, including co-founding SaaS pioneer Reviora, to removing cybersecurity barriers for mid-sized enterprises. Establishing BitLyft in 2016, Jason set out to unburden security teams with innovative, approachable, and affordable solutions, a vision which has made BitLyft a respected managed detection and response provider. Outside his cybersecurity pursuits, Jason is an avid tree farmer and outdoor enthusiast, planting nearly 300 trees on his ten-acre plot and finding joy in hiking, and hunting. His diverse passions mirror the balanced blend of expertise, dedication, and joy he brings to BitLyft. ## More Reading [![How AI Can Transform Your Threat Detection Capabilities](https://www.bitlyft.com/hs-fs/hubfs/iStock-1489487769.jpg?width=400&name=iStock-1489487769.jpg)](https://www.bitlyft.com/bitlyftnews/how-ai-can-transform-your-threat-detection-capabilities) [How AI Can Transform Your Threat Detection Capabilities](https://www.bitlyft.com/bitlyftnews/how-ai-can-transform-your-threat-detection-capabilities) [Cybersecurity Services](https://bitlyft.com/resources/tag/cybersecurity-services) How AI Can Transform Your Threat Detection Capabilities Cyber threats are evolving at an unprecedented pace, making traditional security approaches inadequate for modern enterprises. Attackers are... 3/6/2025 [![How to Quickly Identify and Neutralize Advanced Phishing Threats](https://www.bitlyft.com/hs-fs/hubfs/tlgmarketing_photo_realistic_image_of_hook_and_envelop_reflecti_c32dcab1-5717-455e-9aed-14021562419d.png?width=400&name=tlgmarketing_photo_realistic_image_of_hook_and_envelop_reflecti_c32dcab1-5717-455e-9aed-14021562419d.png)](https://www.bitlyft.com/bitlyftnews/how-to-quickly-identify-and-neutralize-advanced-phishing-threats) [How to Quickly Identify and Neutralize Advanced Phishing Threats](https://www.bitlyft.com/bitlyftnews/how-to-quickly-identify-and-neutralize-advanced-phishing-threats) [Cybersecurity Services](https://bitlyft.com/resources/tag/cybersecurity-services) How to Quickly Identify and Neutralize Advanced Phishing Threats Phishing attacks have become one of the most persistent and dangerous cyber threats businesses face today. Cybercriminals are using... 3/7/2025 [![Cybersecurity-compliance](https://www.bitlyft.com/hs-fs/hubfs/iStock-1467057071.jpg?width=400&name=iStock-1467057071.jpg)](https://www.bitlyft.com/bitlyftnews/bitlyft-supports-companies-with-their-cmmc-compliance-journey) [BitLyft Supports Companies with their CMMC Compliance Journey](https://www.bitlyft.com/bitlyftnews/bitlyft-supports-companies-with-their-cmmc-compliance-journey) BitLyft AIR® Simplifies the Preparation Process for CMMC Certification with Real-Time Monitoring, Automated Reporting, and Compliance Tracking 1/14/2025 [![BitLyft](https://www.bitlyft.com/hubfs/raw_assets/public/bitlyft-2021-new/src/images/BLLogo.svg "BitLyft")](https://www.bitlyft.com) - [BitLyft **AIR**](https://www.bitlyft.com/air) - [Use Cases](https://www.bitlyft.com/industries/education) - [Privacy Policy](https://www.bitlyft.com/privacy-policy) - [Careers](https://www.bitlyft.com/careers) - [Webinars](https://www.bitlyft.com/webinar) - [Blog](https://www.bitlyft.com/resources) - Our Vision - [Contact Us](https://www.bitlyft.com/contact-us) - [News](https://www.bitlyft.com/news) [Follow us on Facebook](https://www.facebook.com/BitLyft) [Follow us on LinkedIn](https://www.linkedin.com/company/bitlyft/) [Follow us on Twitter](https://twitter.com/bitlyft) [Follow us on YouTube](https://www.youtube.com/channel/UCGMnF3PMXFgTotrnPJfC87w) © Copyright 2025 BitLyft. All Rights Reserved. [![BitLyft Cybersecurity](https://www.bitlyft.com/hubfs/BitLyft-header-logo.svg)](https://www.bitlyft.com) Solutions [FeaturedBitLyft AIR® Autonomous SOC — detection, response & remediation on autopilot, around the clock. Explore the platform](https://www.bitlyft.com/air) Our Solutions [BitLyft Agentic MDRFully managed detection & response](https://www.bitlyft.com/agentic-mdr) [Security AutomationAutomate the busywork of defense](https://www.bitlyft.com/security-automation) [Security Operations Center24/7 SOC coverage](https://www.bitlyft.com/security-operations-center-soc) [SIEM ManagementTuned, managed & monitored](https://www.bitlyft.com/security-information-and-event-management-siem) [Central Threat IntelligenceShared signal across customers](https://www.bitlyft.com/central-threat-intelligence) [BitLyft AIR®Automated incident response](https://www.bitlyft.com/air) [What is AMDR?](https://www.bitlyft.com/solutions/what-is-amdr) [Plans & pricing](https://www.bitlyft.com/pricing) [Compare MDR vs. AIR NEW](https://www.bitlyft.com/true-mdr) Industries [Compliance-readyDoD & CMMC Meet CMMC and NIST 800-171 with security operations built for regulated sectors. See compliance coverage](https://www.bitlyft.com/cmmc) Industries we protect [Banking](https://www.bitlyft.com/banking) [FinTech](https://www.bitlyft.com/managed-detection-and-response-for-fintech) [Public Utilities](https://www.bitlyft.com/managed-detection-and-response-for-public-utilities) [DoD (CMMC)](https://www.bitlyft.com/cmmc) [NIST 800-171](https://www.bitlyft.com/nist-800-171) [Healthcare](https://www.bitlyft.com/managed-detection-and-response-for-healthcare) [Higher Education](https://www.bitlyft.com/higher-education) [AI Data Center Security](https://www.bitlyft.com/ai-data-center-security) [Cybersecurity for Aerospace](https://www.bitlyft.com/cybersecurity-for-aerospace) [Energy & Utilities](https://www.bitlyft.com/energy-and-utilities) [Manufacturing](https://www.bitlyft.com/agentic-mdr-for-manufacturing) [Pricing](https://www.bitlyft.com/pricing) [Partners](https://www.bitlyft.com/partners) Company [Who we areAbout BitLyft On a mission to make elite cybersecurity accessible to every organization. Our story](https://www.bitlyft.com/about-us) Company [About Us](https://www.bitlyft.com/about-us) [Careers](https://www.bitlyft.com/careers) [Contact Us](https://www.bitlyft.com/contact-us) Resources [LearnBitLyft Blog Threat research, how-to guides and security insights from our SOC team. Read the blog](https://www.bitlyft.com/resources) Resources [Blog](https://www.bitlyft.com/resources) [Newsroom](https://www.bitlyft.com/news) [Case Studies](https://www.bitlyft.com/case-studies) [Downloads](https://www.bitlyft.com/downloads) [Experienced a Breach?](https://bitlyft.com/emergency-incident-response) [Request a Demo](https://www.bitlyft.com/request-a-demo) [Request a Demo](https://www.bitlyft.com/request-a-demo)