mountlocker

MountLocker is a ransomware group that emerged in February 2021, operating primarily with financial motivations through targeted attacks against enterprise networks. The group appears to operate independently rather than as a Ransomware-as-a-Service model, with limited public information available regarding their country of origin or affiliations to other cybercriminal organizations. MountLocker typically gains initial access through compromised Remote Desktop Protocol (RDP) credentials and exploits vulnerabilities in internet-facing applications, subsequently deploying their custom ransomware payload that encrypts files and demands payment for decryption keys. Based on documented incidents, the group has demonstrated a particular focus on targeting transportation systems infrastructure, with approximately 18 known victims identified through their operations. The group's current operational status remains unclear, as public reporting on MountLocker activities has been limited compared to more prominent ransomware families, though no definitive law enforcement disruption has been publicly announced.