Skip to main content
Darkfield

Operator dossier

Mount-Locker (also tracked as Mount Locker, mountlocker) is a ransomware operator currently active on public leak sites. Darkfield has indexed 18 public victims claimed by this operator between February 7, 2021 and February 8, 2022. Auto-discovered from ransomware tracking sources

Most-targeted sectors

Recent disclosures by Mount-Locker

All 18 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Mount-Locker →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Mount-Locker

aka Mount Locker, mountlocker · 18 victims indexed · first seen 5 years ago · last activity 4 years ago

18
Victims indexed
#166 of 364 tracked operators
1y 0m
Active period
Feb 2021 → Feb 2022
—
Countries hit

At a glance

Status
active
Aliases
Mount Locker, mountlocker
First seen
5 years ago
Last activity
4 years ago
Onion sites
1 known endpoint
Primary sector
Transportation Systems · 1 hits

About

Auto-discovered from ransomware tracking sources

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

3 months
2021-02-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 162022-02-01T00:00:00+00:00 · 1
2021-02-01T00:00:00+00:002022-02-01T00:00:00+00:00

Top sectors

Transportation Systems
1
Construction
1
Transportation Systems dossier →Construction dossier →

Recent victims

Loading…

Onion infrastructure

1 known
  • http://mountnewsokhwilx.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Mount-Locker posts a victim.

Add Mount-Locker to your watchlist — Pro pings you within 5 minutes of any new Mount-Locker leak-site post, Telegram callout, or affiliate-rebrand inference.