MountLocker Ransomware Provides a Glimpse into What’s Next in Ransomware-as-a-Service



MountLocker RAnsomware Provides Ransomware-as-a-ServiceThis family of ransomware is growing in popularity with affiliates, providing them with two attack variants and appears to be establishing a new “as-a-service” business model.

Hot on the heels of the news of Maze ransomware “retiring” last month, security researchers are seeing trends in other ransomware families that may provide insight into what you should expect to see in the new year.

According to BlackBerry’s Research and Intelligence Team, the ransomware to keep an eye on is MountLocker. Offered as Ransomware-as-a-Service, MountLocker has been around since July. But it’s tactics and how it partners with affiliates has researchers concerned.

First there’s the tactics. MountLocker can operate in two fashions – one that targets 2600 file extensions to encrypt, and another that simply excludes 14 specific extensions, leaving everything else to be encrypted.

Next there’s the very unique affiliate relationship MountLocker has with its cybercriminal partners. It appears that rather than affiliates signing up to use the ransomware and then attacking, MountLocker’s affiliates do the opposite. According to BlackBerry, threat actors breach a network, then negotiate with MountLocker on the affiliate fees, resuming attacks once a fee is negotiated. Additionally, MountLocker also engages in “blackmail and extortion tactics” working in conjunction with their affiliates (who are also performing the same actions) to double the offensive in the hopes of collecting a ransom from the victim organization.

Cybercriminal organizations are getting more organized, are developing crafty partnerships and business models that – like any legitimate business – work to increase “revenues.”

BlackBerry says MountLocker is “just warming up” meaning they expect to see more of this ransomware family into 2021.

As with most attacks, the threat actors need a way in. Even today, it still boils down to RDP access (which you can disable and simply not use) and successful phishing attacks (which can be materially reduced through the use of Security Awareness Training to increase user vigilance when interacting with email and the web).


Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Topics: Ransomware



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews