Search threats, CVEs… ⌘K
← Back to all threat actors

mountlocker

MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and leveraging compromised RDP credentials for initial access, propagating laterally via Windows Active Directory APIs and targeting over 2,600 file extensions.

How we source and review actor profiles
Motivation
ransomware
Last seen
2022-02-08
Sectors
manufacturing, transportation, professional-services, retail-e-commerce, healthcare, financial-services
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
RelationshipSame as relationship with mount-locker

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

High
First listed
Victim claimDassault Falcon Jet listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

First listed
Victim claimMemry Corporation listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThyssenKrupp System Engineering listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCentury 3, Inc. listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAmey plc listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTranstar1 listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimWasserstorm listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMERSEN listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGeotech Engineering and Testing listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLaboratorios SMA S.A.C. listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMakalot listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGunnebo AB listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimEnerstar Rentals & Services listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimForrester Construction listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHomeland Title listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFAPS Inc. listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNachi America Inc. listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimECU Worldwide listed by mountlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

mountlockerCanonical Name

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Same actor high
mountlocker preferred mount-locker

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

Same as: mount-locker

Loading CVEs, techniques, indicators, malware, victims, and activity...