MountLocker ransomware now working through criminal affiliates

Ransomware-as-a-service could become a major threat, warns BlackBerry researchers

Visual representation of ransomware by showing encrypted files on a display

Security researchers have warned of a new strain of ransomware that uses affiliates to spread the malware

In a blog post, researchers at BlackBerry said that MountLocker has been available as ransomware as a service since July and was updated in November to broaden the file types it targeted and evade security software.

The malware itself, at less than 100Kb in size, is lightweight and simple in construction. It is typically deployed as either an x86 or x64 Windows portable executable (PE) file, although occasionally as a Microsoft Installer (MSI) package.

The ransomware encrypts data of victims and demands Bitcoin as ransom. The hackers also threaten to leak stolen information if money is not received.

BlackBerry researchers said that the ransomware uses an affiliate scheme to find victims. Its investigations found that threat actors often used remote desktop (RDP) with compromised credentials to gain access to a victim’s environment. In one instance, after establishing a foothold in an organisation, there was a delay of several days before activity resumed.

“It is likely that the threat actors were negotiating with the MountLocker operators to join their affiliate program and obtain the ransomware during this pause. Upon obtaining the MountLocker ransomware, the threat actors were observed returning with several “public” tools, including CobaltStrike Beacon and AdFind from Joeware,” researchers said.

Blackberry noted that only five victims are listed on MountLocker's "News & Leaks" site hosted on the darknet, but are likely to increase.

Researchers said that the operators behind MountLocker are “clearly just warming up”.

"After a slow start in July, they are rapidly gaining ground, as the high-profile nature of extortion and data leaks drive ransom demands ever higher. MountLocker affiliates are typically fast operators, rapidly exfiltrating sensitive documents and encrypting them across key targets in a matter of hours,” they said.

Featured Resources

Virtual desktops and apps for dummies

An easy guide to virtual desktop infrastructure, end-user computing, and more

Download now

The total economic impact of optimising and managing your hybrid multi-cloud

Cost savings and business benefits of accelerating the cloud journey

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

What’s next for the education sector?

A new learning experience

Download now

Recommended

Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
Hackers used SonicWall zero-day flaw to plant ransomware
ransomware

Hackers used SonicWall zero-day flaw to plant ransomware

30 Apr 2021
New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
How can you protect your business from crypto-ransomware?
Security

How can you protect your business from crypto-ransomware?

20 Apr 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021