Loading threat actor…
XingLocker is a ransomware operation associated with MountLocker malware and later rebranding activity linked to Quantum. It has been observed in intrusion chains where initial access malware such as IcedID preceded rapid ransomware deployment. The group’s tooling includes a MountLocker variant that encrypts data using a hybrid RSA-2048 and ChaCha20 scheme, drops HTML ransom notes, logs victim and file-operation details, and can self-delete after execution. A notable characteristic of XingLocker-associated MountLocker activity is network-aware propagation and remote execution. The malware can traverse local drives, mapped drives, and network shares, and includes worm-like functionality for spreading across Windows environments. It uses Active Directory discovery to identify other systems, attempts authenticated connections to remote hosts and shares, copies itself to accessible systems, and can launch remotely through Windows services or WMI. The malware also enumerates and stops selected services and terminates processes associated with databases, email, office applications, and analysis tooling in order to facilitate encryption. Intrusions associated with XingLocker have also involved common ransomware post-exploitation tradecraft, including use of IcedID as an entry vector, disabling security tooling, credentialed network access, and lateral movement in enterprise Windows domains. Reporting also indicates that XingLocker later rebranded as Quantum. Known aliases include xinglocker and xing_locker.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation mentioned in the context of using IcedID as a delivery mechanism; noted to have rebranded as Quantum.
Ransomware operators referenced in a case where attackers disabled AV and EDR agents using batch files.
Ransomware operations using MountLocker/MountLocker v5.0 with file encryption, service/process termination, self-deletion, and worm-like self-propagation across Windows domain/network environments via IDirectorySearch, WMI, remote service creation, and shared resource copying.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.