Skip to main content

MountLocker Ransomware

First seen in July 2020, MountLocker is a enterprise targeted ransomware tool. Its operators are attempting to extract seven-figure ransoms from affected parties by threatening to leak data stolen during encryption.

Threat ID:
CC-3624
Category:
Ransomware
Threat Severity:
Medium
Published:
28 September 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

First seen in July 2020, MountLocker is a enterprise targeted ransomware tool. Its operators are attempting to extract seven-figure ransoms from affected parties by threatening to leak data stolen during encryption.

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

MountLocker (AKA Mount Locker) is a newly observed ransomware tool targeting corporate networks in English-speaking countries worldwide.

Delivery

At the time of publication, it is unclear how Mount Locker is delivered. although there are unconfirmed reports suggesting it is being distributed as a secondary payload once it's operators have gained access to target systems.

Activities

Once present on a target system, MountLocker will attempt to extract sensitive files, before encrypting all local non-system files using ChaCha20. An embedded RSA-2048 key is then used to encrypt the keys used by ChaCha20.

Files extracted by MountLocker are then used by its operators to coerce victims into meeting their ransom demands, with those who do not having their data published on a data leak site.

Threat updates

Date Update
29 Apr 2021 Rebranding as "AstroLocker" with sophisticated scripts

MountLocker is rebranding as “AstroLocker” and has added some new features. Designed to disable detection and prevention tools, it is using sophisticated scripts to customise attacks on organisations’ environments. It is using multiple CobaltStrike servers with unique domains for detection evasion. The current campaign is aimed at biotech and healthcare-adjacent industries.
16 Dec 2020 Cut-down new variant

A new MountLocker variant has been observed which is half the size of previous versions of the tool.

Coming in at only 46KB, this new version uses a far smaller target file extension list. Apart from this it appears to be functionally identical to older MountLocker variants.
26 Nov 2020 Tax documents targeted

A new variant of MountLocker now attempts to extract files and documents containing or relating to tax information.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Last edited: 29 April 2021 2:18 pm