Loading story…
Mount Locker emerged as a corporate-targeting ransomware operation that stole data before encrypting files and then demanded multi-million dollar payments while threatening to leak stolen information on a Tor-hosted extortion site. Reporting on early victims said the group had already listed multiple organizations on its leak portal and published at least one victim’s files after nonpayment. The malware used ChaCha20 for file encryption and an embedded RSA-2048 public key to protect encryption material, dropped a ransom note named RecoveryManual.html, and appended a .ReadManual.ID-style extension to encrypted files.
Reverse-engineering of Mount Locker samples and later variants showed the ransomware also included operational features for enterprise-wide impact, including command-line options for targeting hosts, suppressing logs, avoiding process termination controls, and encrypting network resources. Analysts reported that newer builds added worm-like lateral movement by enumerating domain or network systems, requiring /LOGIN= and /PASSWORD= parameters for propagation, copying itself to remote machines, creating services named in an Update{GetTickCount()} pattern, and in some cases launching remotely through WMI under ROOT\CIMV2. The malware was also described as killing selected services and processes before encryption to maximize disruption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Sophos reported that an investigated intrusion initially identified as Mount Locker was closely tied to Astro Locker, with the ransom note's Tor contact identifying itself as Astro Locker Team. Sophos found all five victims on the Astro Locker leak site also appeared on Mount Locker's leak site with matching leak sizes and overlapping data links, and assessed the groups may be affiliated, rebranding, or expanding into ransomware-as-a-service.
A new Mount Locker version was reported to specifically encrypt TurboTax-associated file extensions including .tax, .tax2009, .tax2013, and .tax2014. Analysis cited by BleepingComputer said the matching logic could broadly affect extensions containing the string "tax."
Mount Locker was reported as targeting corporate networks by the end of July 2020. The operation stole data before encrypting files and used leak threats to pressure victims into paying large ransoms.
A later Mount Locker update was described as adding worm functionality that could enumerate domain or network systems and spread using supplied credentials. The analysis said it could drop itself remotely, create Update{GetTickCount()} services, and also use WMI for execution.
MalwareHunterTeam discovered a Mount Locker sample and Michael Gillespie analyzed it, reporting that it used ChaCha20 with an embedded RSA-2048 public key. The sample appended .ReadManual.ID-style extensions and used a RecoveryManual.html note directing victims to a Tor negotiation site.
At least one victim that refused to pay had its stolen files published on Mount Locker's leak site. At the time of reporting, the leak site listed four victims and one had already been exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcekienmanowar.wordpress.com
Open sourcegithub.com
Open sourcechuongdong.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026
NHS England issued a cyber alert on **MountLocker ransomware**, warning organizations about the threat posed by the malware and its potential impact on enterprise environments. The alert identified MountLocker as a ransomware operation capable of disrupting business-critical systems, underscoring the need for defenders to detect and contain infections before encryption and wider operational damage occur. Separate security research published by Improsec examined how **SID filtering** between Active Directory domains can be bypassed, highlighting a technique that could weaken a key trust boundary in Windows environments. The findings are relevant to ransomware defense because abuse of inter-domain trust relationships can enable privilege escalation and lateral movement, increasing the risk that threats such as MountLocker spread across segmented networks.
Jul 12, 2026