Loading malware…
MountLocker is a Windows ransomware family first observed in 2020 and associated in some reporting with the XingLocker ransomware group. It encrypts victim files using a hybrid scheme combining ChaCha20 and RSA-2048, writes ransom notes, profiles the infected host, and can delete itself after execution. MountLocker has also been linked to double-extortion activity in which operators steal unencrypted data and threaten publication to pressure victims into paying.
The malware supports extensive command-line control over its operation. Before encryption it can collect host details such as operating system version, architecture, memory, processor count, user and computer context, and domain status. It enumerates local drives, mapped drives, and network shares, recursively traverses directories, skips selected system paths and file types, and drops ransom notes in affected folders. It also attempts to maximize file access by terminating services and processes associated with databases, email, office applications, and some analysis tools.
A notable capability in later variants is worm-like lateral movement across Windows networks. MountLocker can enumerate domain computers through Active Directory and LDAP-related APIs, authenticate to remote systems with supplied credentials, copy itself to administrative or other writable shares, and execute remotely either by creating a temporary Windows service or through WMI. Reporting also notes use of Active Directory queries to identify systems in the domain, making the malware capable of automated propagation inside enterprise environments.
MountLocker has been observed in enterprise ransomware incidents, including attacks against corporate victims, and has appeared in reporting on financially motivated intrusion ecosystems. It has been mentioned in connection with access-broker activity in which third parties likely provided network access to MountLocker operators. Industries specifically targeted are not consistently exclusive, but the malware has been part of broader big-game hunting and extortion operations affecting organizations in multiple sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Prophet Spider functioned as an access broker and likely granted access to Egregor and MountLocker ransomware operators in exchange for payment.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
"attackers exploit Oracle WebLogic server flaws to access target environments" ... "uses CVE-2020-14882 and CVE-2020-14750 to get a foothold" ... "path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution." | "Prophet Spider has also been seen using older Oracle CVEs such as CVE-2016-0545, as well as gaining initial access via SQL injection."
If the /NETWORK argument provided is w , it launches the executable through Windows Management Instrumentation (WMI).
The function starts parsing the arguments... we can see the strings "/LOGIN=" and "/PASSWORD="... the others are more features/options of MountLocker
First, this full cmd.exe command is built. cmd.exe /c start "ransomware_path PARAMS_VALUE /NOLOG"
EnumServicesStatusA(schSCManager, SERVICE_WIN32, 1u, lpServices ... kills all services with these strings in their name: "SQL", "database", "msexchange"
After creating these worker threads, the main thread begins enumerating the Windows domain that the current host is in.
The client ID embedded inside the ransom note is generated from the victim’s computer name and a hard-coded string in memory.
Seems the worm feature is divided in two categories: Enum PC into domain Enum PC into network
The ransomware first calls ZwQuerySystemInformation with the information class of SystemProcessInformation to get an array of SYSTEM_PROCESS_INFORMATION structures.
Collect victim’s system info: ... CORE COUNT, TOTAL MEM, WIN VER, WIN ARCH, USER NAME, PC NAME, IN DOMAIN, IS ADMIN, IN GROUPS, CMDLINE
f_ml_enum_target_drive ... f_ml_recursive_enum_folder ... check target (folder / file) can be encrypted ... skipped folder is in ignored list
Seems the worm feature is divided in two categories: Enum PC into domain Enum PC into network Both share the need of "/LOGIN=" and "/PASSWORD=" After getting access to the computer it will drop the same executable
wsprintfW(remoteProgramData_path, L"\\\\%s\\C$\\ProgramData", DN_PC_Name); ... CopyFileW(lpMountLockerPath, victim_info->file_path, 0)
check is valid to be encrypted ... f_ml_push_target_in_queue ... Update log stats, deletes itself ... Total crypted | drop a ransom note in the folder ... lstrcatW(&target_info->target_ransom_note_name, L"RecoveryManual.html")
If a service contains any of the three strings above, MountLocker will terminate it by calling OpenServiceA to obtain a service control handle and calling ControlService to send a control stop code. | If the process name is in the list, it calls OpenProcess to get the handle of that process and terminates it using TerminateProcess.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family referenced as a downstream payload/operator that may have received access from Prophet Spider for ransomware deployment.
MountLocker is a ransomware family that encrypts files, drops a ransom note named RecoveryManual.html, gathers victim system information, kills services and processes that may interfere with encryption, skips selected folders and file types, can propagate laterally across a domain via LDAP enumeration, SMB share copying, remote service creation, and WMI execution, logs encryption statistics, and can delete itself after execution.
Referenced for comparison as ransomware that previously used Windows Active Directory APIs to perform LDAP queries.
MountLocker is ransomware that encrypts files using a hybrid RSA-2048 and ChaCha20 scheme, appends encrypted key material to each file, drops an HTML ransom note, kills selected services and processes, can self-delete, and in this version includes worm-like propagation across networks via LDAP/Active Directory discovery, SMB share copying, service creation, and WMI-based remote execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.