BreachCensus

mountlocker

First seen February 7, 2021Active18 claimed victims

The claims below are reproduced as posted by mountlocker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.

Listed organisation? Contact [email protected].

Profile

MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and leveraging compromised RDP credentials for initial access, propagating laterally via Windows Active Directory APIs and targeting over 2,600 file extensions.

Description from ransomware.live.

Claimed victims (as posted by the group — unverified)

Victim (as posted)Claimed onSourcePress coverage
Dassault Falcon JetFebruary 8, 2022ransomware_live
Nachi America Inc.September 9, 2021ransomware_live
FAPS Inc.September 9, 2021ransomware_live
Homeland TitleSeptember 9, 2021ransomware_live
Forrester ConstructionSeptember 9, 2021ransomware_live
Enerstar Rentals & ServicesSeptember 9, 2021ransomware_live
Gunnebo ABSeptember 9, 2021ransomware_live
MakalotSeptember 9, 2021ransomware_live
Laboratorios SMA S.A.C.September 9, 2021ransomware_live
Geotech Engineering and TestingSeptember 9, 2021ransomware_live
MERSENSeptember 9, 2021ransomware_live
WasserstormSeptember 9, 2021ransomware_live
Transtar1September 9, 2021ransomware_live
Amey plcSeptember 9, 2021ransomware_live
Century 3, Inc.September 9, 2021ransomware_live
ThyssenKrupp System EngineeringSeptember 9, 2021ransomware_live
Memry CorporationSeptember 9, 2021ransomware_live
ECU WorldwideFebruary 7, 2021ransomware_live

Claim data from ransomware.live and RansomLook (CC BY 4.0).