MountLocker ransomware now working through criminal affiliates

Security researchers have warned of a new strain of ransomware that uses affiliates to spread the malware.

In a blog post, researchers at BlackBerry said that MountLocker has been available as ransomware as a service since July and was updated in November to broaden the file types it targeted and evade security software.

The malware itself, at less than 100Kb in size, is lightweight and simple in construction. It is typically deployed as either an x86 or x64 Windows portable executable (PE) file, although occasionally as a Microsoft Installer (MSI) package.

The ransomware encrypts data of victims and demands Bitcoin as ransom. The hackers also threaten to leak stolen information if money is not received.

BlackBerry researchers said that the ransomware uses an affiliate scheme to find victims. Its investigations found that threat actors often used remote desktop (RDP) with compromised credentials to gain access to a victim’s environment. In one instance, after establishing a foothold in an organisation, there was a delay of several days before activity resumed.

“It is likely that the threat actors were negotiating with the MountLocker operators to join their affiliate program and obtain the ransomware during this pause. Upon obtaining the MountLocker ransomware, the threat actors were observed returning with several “public” tools, including CobaltStrike Beacon and AdFind from Joeware,” researchers said.

Blackberry noted that only five victims are listed on MountLocker's "News & Leaks" site hosted on the darknet, but are likely to increase.

Researchers said that the operators behind MountLocker are “clearly just warming up”.

"After a slow start in July, they are rapidly gaining ground, as the high-profile nature of extortion and data leaks drive ransom demands ever higher. MountLocker affiliates are typically fast operators, rapidly exfiltrating sensitive documents and encrypting them across key targets in a matter of hours,” they said.