Loading malware…
Quantum is a Windows ransomware family used in financially motivated ransomware-as-a-service operations targeting mid-market and large enterprises. Its operators combine file encryption with data theft to support double extortion, threatening disclosure of stolen information in addition to demanding payment for recovery. Quantum-associated activity has been linked to former Conti members, and ShadowSyndicate and Vanilla Tempest have been associated with its deployment.
Observed infection chains have begun with phishing emails containing malicious Office documents whose macros execute encoded PowerShell commands and install Emotet. IcedID has also been used to deliver Quantum. Following initial compromise, attackers have used Cobalt Strike for discovery and lateral movement, and legitimate remote administration tools such as AnyDesk and Tactical RMM to maintain remote access. Quantum incidents have included data exfiltration using Rclone followed by domain-wide ransomware deployment. PsExec and Windows Management Instrumentation have been used for remote execution during these attacks. These supporting tools and behaviors belong to the broader intrusion chain rather than necessarily being built into the ransomware executable.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“We have found evidence that points to a possible connection between Play ransomware and Quantum ransomware ... which is an offshoot of the notorious Conti ransomware group.”
Security researchers from Group-IB have been able to link this group to various ransomware incidents in the past, which include Quantum ransomware activity in September 2022.
...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
...Stern has transacted with addresses linked to strains like Quantum, Karakurt, Diavol, and Royal in 2022 following Conti’s demise.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Using SECONDDATE and QUANTUM, the NSA's Tailored Access Operations hacking team infected an internal staff network in Pakistan’s National Telecommunications Corporation, and quietly installed surveillance code on four ZXJ10 switches.
The NSA uses these fast Quantum servers to execute a packet injection attack, which surreptitiously redirects the target to the FoxAcid server.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond... In the academic literature, these are called 'man-in-the-middle' attacks... More specifically, they are examples of 'man-on-the-side' attacks.
By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond... In the academic literature, these are called 'man-in-the-middle' attacks... More specifically, they are examples of 'man-on-the-side' attacks.
After successfully connecting to the C2 server, IcedID drops the payload in ProgramData folder
The NSA uses these fast Quantum servers to execute a packet injection attack, which surreptitiously redirects the target to the FoxAcid server.
2023 年 1 月には新たな亜種「 LockBit Green 」も発見されている活発なランサムウェアです。
2重脅迫を行う暴露型ランサムウェアを中心とした脅威動向の各種把握に是非広くご活用いただければ幸いです!
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.