Loading malware…
Mount Locker is a human-operated Windows ransomware family and ransomware operation that emerged in mid-2020 and is associated with double-extortion attacks. Operators typically compromise enterprise networks prior to deployment, steal data for blackmail, then encrypt victim systems and threaten publication of stolen information through dedicated leak infrastructure and Tor-based negotiation portals. Reporting has linked likely access patterns to compromised credentials and exposed remote access services, including RDP and remote management, rather than indiscriminate mass infection.
Technically, Mount Locker has been observed using ChaCha20 for file encryption together with an embedded RSA public key to protect encryption material. Analyses of later variants describe operator-oriented command-line options, mutex creation to prevent duplicate execution, broad process and service termination before encryption, deletion of shadow copies, registration of encrypted-file associations so opening encrypted files launches the HTML ransom note, and self-deletion after execution. Some samples were delivered through VB6-based loader components that unpacked and self-injected the ransomware payload, while 64-bit executions have also been observed as DLLs launched manually through Rundll32. Research on Version 2 noted that the malware remained relatively immature in some respects, with verbose logging, incomplete network-share encryption support in observed builds, no meaningful persistence, and operational flaws including the ability to render Windows systems unbootable when run with sufficient privileges.
Mount Locker has been used against corporate environments and has shown selective targeting behavior, including versions that specifically encrypted TurboTax-related files during tax season. The operation is materially connected in public reporting to Astro Locker, with overlapping leak-site victims, ransom-note characteristics, and tradecraft suggesting either a rebrand, affiliate relationship, or shared operational backend. Mount Locker has also appeared in broader ransomware affiliate ecosystems and has been discussed in connection with access brokers and other malware operators. Overall, Mount Locker is best characterized as a targeted, operator-driven ransomware threat focused on enterprise extortion through combined encryption and data theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Astro Locker TeamはMount Lockerというランサムウェアを用いる旧来の攻撃グループと繋がりがあり、新しいブランドイメージに一新する目的等で新たに作成されたランサムウェア攻撃グループのブランドであるという見解が一部で見られています。
22 distinct techniques documented for this family, organized by ATT&CK tactic.
旧来のMount Lockerの攻撃においては侵害された資格情報によるRDPへの不正アクセスによりターゲット環境へ侵入する手口などが過去に確認されています。
The ransomware will then register the extension in the Registry so that when you click on an encrypted file, it will automatically load the ransom note.
Apparently this sample utilizes Self-Injection, so the call to CreateProcessInternalW won't take us to the unpacked Child Process but rather a Powershell script.
旧来のMount Lockerの攻撃においては侵害された資格情報によるRDPへの不正アクセスによりターゲット環境へ侵入する手口などが過去に確認されています。
Both of the samples ... were obviously altered to act as a packer for it ... load the PE resource ... call to VirtualAlloc ... VirtualProtect and RtlMoveMemory ... moving the payload there.
when encrypting files, the ransomware will add an extension in the format .ReadManual.ID . For example, 1.doc would be encrypted and renamed to 1.doc.ReadManual.C77BFF8C
Apparently this sample utilizes Self-Injection, so the call to CreateProcessInternalW won't take us to the unpacked Child Process but rather a Powershell script.
After the Ransomware finished the encryption routine and if the /nodel flag was not supplied it's time to clean up and Mount Locker will delete itself by invoking e.g. cmd /c ... .bat
旧来のMount Lockerの攻撃においては侵害された資格情報によるRDPへの不正アクセスによりターゲット環境へ侵入する手口などが過去に確認されています。
MITRE ATT&CK T1134 --> Access Token Manipulation --> Defense Evasion, Privilege Escalation
ransomware attackers are using virtual machines (VMs) in order to run their ransomware payloads on compromised computers. The motivation behind the tactic is stealth. In order to avoid raising suspicions or triggering antivirus software, the ransomware payload will “hide” within a VM while encrypting files on the host computer.
The generation of the ClientID is based on the return of GetComputerName ... To make sure the Ransomware only runs once on a particular system it will create a Mutex that is derived from the Volume Serialnumber of the System Drive
Mount Locker will separate its log output by the volume type of the targeted drive ... the encryption of Network Shares is not supported yet ... Mount Locker ships with a list of Directory Paths and extensions to be spared from encryption
ransomware attackers are using virtual machines (VMs) in order to run their ransomware payloads on compromised computers. The motivation behind the tactic is stealth. In order to avoid raising suspicions or triggering antivirus software, the ransomware payload will “hide” within a VM while encrypting files on the host computer.
最近のランサムウェアと同じく、ファイルを暗号化して身代金を要求し、応じない場合はあらかじめ盗み取っておいたデータをリークサイトで公開すると脅す2重脅迫の手口で使用されるランサムウェアです。
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware referenced as similar to Astro Locker.
Ransomware used in the incident; Sophos observed it being executed via rundll32 and assessed that Astro Locker and Mount Locker both use Mount Locker ransomware, the same ransom note, and overlapping TTPs. The article discusses possible rebranding or affiliate/RaaS relationships around this family.
Referenced as a ransomware collective associated with Qbot partnerships. No further details provided.
Ransomware observed on the same compromised computer; possibly used as the host-based payload if the VM-based deployment failed.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.