Mountlocker
| RaaS
MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and leveraging compromised RDP credentials for initial access, propagating laterally via Windows Active Directory APIs and targeting over 2,600 file extensions.
Victims
18
First Victim
2021-02-07
(est. attack date)
Discovery Date
2021-02-07
Last Seen
2022-02-08
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
0.0%
victims with domain
Countries
0
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
No | 2026-08-22T09:02:11 |
mountnewsokhwilx.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 10
- Transportation 3
- Professional Services 2
- Retail & E-Commerce 1
- Healthcare 1
Top 5 Countries
Heatmap
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
|
|
|
|
|
|
|
MEGA
PrivatLab
|
YARA Rules (2)
Victims (18)
