Skip to main content
Darkfield

Operator dossier

Quantum (also tracked as QuantumLocker, Mount Locker, DagonLocker) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 68 public victims claimed by this operator between September 9, 2021 and December 9, 2022. Quantum is a ransomware group that emerged in September 2021, operating with primarily financial motivations and demonstrating a focus on high-value targets across English-speaking nations. The group's geographic targeting patterns and operational characteristics suggest possible connections to established ransomware ecosystems, though specific attribution or confirmed affiliations with other threat actors remain undocumented in public reporting. Quantum operators typically employ double extortion tactics, combining data encryption with the threat of public data exposure to maximize pressure on victims, and their campaigns have consistently targeted sectors with critical operational dependencies including business services, manufacturing, and information technology infrastructure. The group has maintained a relatively low public profile compared to other major ransomware operations, with their 68 documented victims representing a more selective approach to target acquisition rather than broad-scale campaigns. Despite limited public law enforcement reporting specifically focused on Quantum operations, the group's continued activity pattern suggests they remain an active threat as of recent observations, though comprehensive operational details remain scarce in publicly available threat intelligence reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by Quantum

All 68 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Quantum →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Quantum

aka QuantumLocker, Mount Locker, DagonLocker · 68 victims indexed · first seen 5 years ago · last activity 4 years ago

68
Victims indexed
#95 of 364 tracked operators
1y 3m
Active period
Sep 2021 → Dec 2022
10
Countries hit
top United States · 25

At a glance

Status
inactive
Aliases
QuantumLocker, Mount Locker, DagonLocker
First seen
5 years ago
Last activity
4 years ago
Onion sites
5 known endpoints
Primary sector
Business Services · 8 hits

About

Quantum is a ransomware group that emerged in September 2021, operating with primarily financial motivations and demonstrating a focus on high-value targets across English-speaking nations. The group's geographic targeting patterns and operational characteristics suggest possible connections to established ransomware ecosystems, though specific attribution or confirmed affiliations with other threat actors remain undocumented in public reporting. Quantum operators typically employ double extortion tactics, combining data encryption with the threat of public data exposure to maximize pressure on victims, and their campaigns have consistently targeted sectors with critical operational dependencies including business services, manufacturing, and information technology infrastructure. The group has maintained a relatively low public profile compared to other major ransomware operations, with their 68 documented victims representing a more selective approach to target acquisition rather than broad-scale campaigns. Despite limited public law enforcement reporting specifically focused on Quantum operations, the group's continued activity pattern suggests they remain an active threat as of recent observations, though comprehensive operational details remain scarce in publicly available threat intelligence reporting.

References

18 links

External sources curated by the MISP threat-intel community.

Timeline

14 months
2021-09-01T00:00:00+00:00 · 12021-11-01T00:00:00+00:00 · 42021-12-01T00:00:00+00:00 · 72022-01-01T00:00:00+00:00 · 12022-02-01T00:00:00+00:00 · 32022-04-01T00:00:00+00:00 · 152022-05-01T00:00:00+00:00 · 72022-06-01T00:00:00+00:00 · 72022-07-01T00:00:00+00:00 · 52022-08-01T00:00:00+00:00 · 52022-09-01T00:00:00+00:00 · 22022-10-01T00:00:00+00:00 · 22022-11-01T00:00:00+00:00 · 32022-12-01T00:00:00+00:00 · 6
2021-09-01T00:00:00+00:002022-12-01T00:00:00+00:00

Top countries

🇺🇸 United States
25
🇨🇦 Canada
6
🇦🇺 Australia
3
🇬🇧 United Kingdom
2
🇰🇼 Kuwait
1
🇮🇱 Israel
1
🇩🇴 Dominican Republic
1
🇳🇱 Netherlands
1
United States dossier →Canada dossier →Australia dossier →United Kingdom dossier →

Top sectors

Business Services
8
Manufacturing
7
Education
3
Information Technology
3
Wholesale & Retail
2
Engineering
2
Law Firms & Legal Services
2
Government
2
Business Services dossier →Manufacturing dossier →Education dossier →Information Technology dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

5 known
  • http://22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion
  • http://22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion/
  • http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion
  • http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion/
  • http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Quantum posts a victim.

Add Quantum to your watchlist — Pro pings you within 5 minutes of any new Quantum leak-site post, Telegram callout, or affiliate-rebrand inference.