mountlocker
First seen February 7, 2021Active18 claimed victims
The claims below are reproduced as posted by mountlocker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and leveraging compromised RDP credentials for initial access, propagating laterally via Windows Active Directory APIs and targeting over 2,600 file extensions.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Dassault Falcon Jet | February 8, 2022 | ransomware_live | — |
| Nachi America Inc. | September 9, 2021 | ransomware_live | — |
| FAPS Inc. | September 9, 2021 | ransomware_live | — |
| Homeland Title | September 9, 2021 | ransomware_live | — |
| Forrester Construction | September 9, 2021 | ransomware_live | — |
| Enerstar Rentals & Services | September 9, 2021 | ransomware_live | — |
| Gunnebo AB | September 9, 2021 | ransomware_live | — |
| Makalot | September 9, 2021 | ransomware_live | — |
| Laboratorios SMA S.A.C. | September 9, 2021 | ransomware_live | — |
| Geotech Engineering and Testing | September 9, 2021 | ransomware_live | — |
| MERSEN | September 9, 2021 | ransomware_live | — |
| Wasserstorm | September 9, 2021 | ransomware_live | — |
| Transtar1 | September 9, 2021 | ransomware_live | — |
| Amey plc | September 9, 2021 | ransomware_live | — |
| Century 3, Inc. | September 9, 2021 | ransomware_live | — |
| ThyssenKrupp System Engineering | September 9, 2021 | ransomware_live | — |
| Memry Corporation | September 9, 2021 | ransomware_live | — |
| ECU Worldwide | February 7, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).