Credential Theft
- Mimikatz
- ProcDump
Quantum
Quantum ransomware is a double-extortion ransomware operation associated with the post-Conti Russian-speaking cybercrime ecosystem.
Profile source: Mallory opens in a new tabQuantum
Family profile
Quantum ransomware is a double-extortion ransomware operation associated with the post-Conti Russian-speaking cybercrime ecosystem. It encrypts victim environments and exfiltrates data to pressure victims with threatened publication or sale of stolen information. Quantum was active against mid-market and larger enterprises and has been associated with domain-wide ransomware deployment following prolonged intrusions involving reconnaissance, lateral movement, remote-access tooling, and data theft. Reporting on the Conti ecosystem describes Quantum as a successor subgroup formed after Conti’s 2022 breakup; Quantum subsequently rebranded as Royal, which later became BlackSuit. Quantum has also been linked to ransomware affiliate and infrastructure overlap involving Conti-associated actors.
Capabilities
- Exfiltration
- Extortion
Operational record
1
YARA rules
2
Leak sites
0 available
Discovery Enum
- AdFind
Exfiltration
- MEGA
- RClone
LOLBAS
- PsExec
- WMIC
Offsec
- Cobalt Strike
RMM Tools
- AnyDesk
- Atera
- RSAT
- Splashtop
Reported operators
Threat actors
3 named in public reporting...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
Conti disbanded later that year, but members of the Cyrillic-language group rebranded under three subgroups: Zeon, Black Basta and Quantum, which quickly rebranded to Royal, before rebranding again to BlackSuit in 2024.
...Stern has transacted with addresses linked to strains like Quantum, Karakurt, Diavol, and Royal in 2022 following Conti’s demise.
MITRE ATT&CK
Quantum in ATT&CK
7 distinct techniquesReporting
Research mentioning Quantum
Jul 16
Register Security
Telegram shortlinks knocked offline over sanctioned VPN connection
The U.S. Treasury sanctioned First VPN Service (1VPNS), its alleged Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly supporting ransomware and other cybercriminal activity. Officials said 1VPNS provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under Executive Order 14390 and E.O. 13694 as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of 1VPNS infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including Anubis, Qilin, and Sinobi Group to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Jul 15
Scworld
U.S. sanctions VPN provider and cryptor seller for aiding ransomware gangs | brief | SC Media
Jul 15
Xakep
Власти США наложили санкции на First VPN из-за связей с вымогателями - Хакер
Jul 14
Security Affairs
U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses
Jul 14
Cyberscoop
US sanctions First VPN and administrator for supporting ransomware | CyberScoop
Jul 14
Chainalysis
“Stern” Ransomware Operator Sanctioned by EU
Jul 14
Cyber Security News
US Treasury Sanctions VPN Service that Helped Ransomware Actors to Attack Organizations
Jul 14
The Hacker News
