Data by ransomware.live Windows

MountLocker

MountLocker is a Windows ransomware family first observed in 2020 and associated in some reporting with the XingLocker ransomware group.

Profile source: Mallory

MountLocker

Family profile

MountLocker is a Windows ransomware family first observed in 2020 and associated in some reporting with the XingLocker ransomware group. It encrypts victim files using a hybrid scheme combining ChaCha20 and RSA-2048, writes ransom notes, profiles the infected host, and can delete itself after execution. MountLocker has also been linked to double-extortion activity in which operators steal unencrypted data and threaten publication to pressure victims into paying.

The malware supports extensive command-line control over its operation. Before encryption it can collect host details such as operating system version, architecture, memory, processor count, user and computer context, and domain status. It enumerates local drives, mapped drives, and network shares, recursively traverses directories, skips selected system paths and file types, and drops ransom notes in affected folders. It also attempts to maximize file access by terminating services and processes associated with databases, email, office applications, and some analysis tools.

A notable capability in later variants is worm-like lateral movement across Windows networks. MountLocker can enumerate domain computers through Active Directory and LDAP-related APIs, authenticate to remote systems with supplied credentials, copy itself to administrative or other writable shares, and execute remotely either by creating a temporary Windows service or through WMI. Reporting also notes use of Active Directory queries to identify systems in the domain, making the malware capable of automated propagation inside enterprise environments.

MountLocker has been observed in enterprise ransomware incidents, including attacks against corporate victims, and has appeared in reporting on financially motivated intrusion ecosystems. It has been mentioned in connection with access-broker activity in which third parties likely provided network access to MountLocker operators. Industries specifically targeted are not consistently exclusive, but the malware has been part of broader big-game hunting and extortion operations affecting organizations in multiple sectors.

Capabilities

Defense Evasion
Exfiltration
Extortion
Lateral Movement
Reconnaissance

Operational record

YARA rules

Leak sites

0 available

Exfiltration

MEGA
PrivatLab

Reported operators

Threat actors

1 named in public reporting

ToyMaker

Prophet Spider functioned as an access broker and likely granted access to Egregor and MountLocker ransomware operators in exchange for payment.

Exploited software

Vulnerabilities linked to MountLocker

2 CVEs

CVE-2020-14750 Oracle WebLogic Server Console path traversal patch bypass leading to unauthenticated RCE CVE-2020-14882 Unauthenticated RCE in Oracle WebLogic Server Console

MITRE ATT&CK

MountLocker in ATT&CK

29 distinct techniques

Techniques

29 techniques

T1489 Service Stop T1486 Data Encrypted for Impact T1070.004 File Deletion T1021.004 SSH T1047 Windows Management Instrumentation T1570 Lateral Tool Transfer T1129 Shared Modules T1018 Remote System Discovery T1059.003 Windows Command Shell T1135 Network Share Discovery T1057 Process Discovery T1033 System Owner/User Discovery T1007 System Service Discovery T1078 Valid Accounts T1083 File and Directory Discovery T1021 Remote Services T1082 System Information Discovery T1112 Modify Registry T1021.002 SMB/Windows Admin Shares T1543.003 Windows Service T1482 Domain Trust Discovery T1105 Ingress Tool Transfer T1046 Network Service Discovery T1569.002 Service Execution T1059 Command and Scripting Interpreter T1567 Exfiltration Over Web Service T1657 Financial Theft T1537 Transfer Data to Cloud Account T1190 Exploit Public-Facing Application

Reporting

Research mentioning MountLocker

Jan 1

Sophos Threat Research

Sophos MTR in Real Time: What is Astro Locker Team? | SOPHOS

Mount Locker emerged as a corporate-targeting ransomware operation that stole data before encrypting files and then demanded multi-million dollar payments while threatening to leak stolen information on a Tor-hosted extortion site. Reporting on early victims said the group had already listed multiple organizations on its leak portal and published at least one victim’s files after nonpayment. The malware used ChaCha20 for file encryption and an embedded RSA-2048 public key to protect encryption material, dropped a ransom note named RecoveryManual.html, and appended a .ReadManual.ID-style extension to encrypted files. Reverse-engineering of Mount Locker samples and later variants showed the ransomware also included operational features for enterprise-wide impact, including command-line options for targeting hosts, suppressing logs, avoiding process termination controls, and encrypting network resources. Analysts reported that newer builds added worm-like lateral movement by enumerating domain or network systems, requiring /LOGIN= and /PASSWORD= parameters for propagation, copying itself to remote machines, creating services named in an Update{GetTickCount()} pattern, and in some cases launching remotely through WMI under ROOT\CIMV2. The malware was also described as killing selected services and processes before encryption to maximize disruption.

Aug 4

Kienmanowar