Mount Locker
Aliases: Mount-Locker, DagonLocker, MountLocker, QuantumLocker
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:54:57
Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector energy-and-utilities technology-and-telecommunications
Context
Mount Locker is a sophisticated ransomware that not only encrypts files on targeted systems, but also exfiltrates sensitive data to use in double extortion schemes.
Detection coverage
- 3 YARA rules
Used by threat actors
- Prophet Spider (threat-actor)
Detection rules
- ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 (yara-rule)
- DITEKSHEN_MALWARE_Win_Mountlocker (yara-rule)
- ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 (yara-rule)
Reports & references
- securityintelligence.com — Itg23 Crypters Cooperation Between Cybercriminal Groups (report)
- CrowdStrike — Report2021Gtr (report)
- CrowdStrike — Prophet Spider Exploits Oracle Weblogic To Facilitate Ransomware Activity (report)
- Microsoft — Dev 0832 Vice Society Opportunistic Ransomware Campaigns Impacting Us Education Sector (report)
- Microsoft — Re54L7V (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- intel471.com — How Cybercriminals Create Turbulence For The Transportation Industry (report)
- Broadcom/Symantec — Ransomware Virtual Machines (report)
- cyclonis.com — Mount Locker Ransomware More Dangerous (report)
- bleepingcomputer.com — Mount Locker Ransomware Joins The Multi Million Dollar Ransom Game (report)
- securitymagazine.com — 94954 Sophos Identifies Connection Between Mount Locker And Astro Locker Team Ransomware (report)
- ransomlook.io — Mount Locker (report)
- news.sophos.com — Sophos Mtr In Real Time What Is Astro Locker Team (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Mount Locker (report)
- securityscorecard.pathfactory.com — Quantum Ransomware (report)
- bleepingcomputer.com — Mount Locker Ransomware Now Targets Your Turbotax Tax Returns (report)
- dissectingmalwa.re — Between A Rock And A Hard Place Exploring Mount Locker Ransomware (report)
- blogs.blackberry.com — Mountlocker Ransomware As A Service Offers Double Extortion Capabilities To Affiliates (report)
- chuongdong.com — Mountlockerransomware (report)
- kienmanowar.wordpress.com — Quicknote Mountlocker Some Pseudo Code Snippets (report)
- cybereason.com — Cybereason Vs. Quantum Locker Ransomware (report)
- noticeofpleadings.com — 1%20 Microsoft%20Cobalt%20Strike%20 %20Complaint(907040021.9) (report)
- bleepingcomputer.com — Law Enforcement Seizes Blacksuit Ransomware Leak Sites (report)
- securityintelligence.com — Trickbot Conti Crypters Where Are They Now (report)
- community.riskiq.com — 47766Fbd (report)