.png)
BOOK THIS SPACE FOR AD
ARTICLE ADThe operators behind new ransomware dubbed Mount Locker have adopted the same tactic of other gangs threatening the victims to leak stolen data.
A new ransomware gang named Mount Locker has started its operations stealing victims’ data before encrypting.
According to BleepingComputer, the ransomware operators are demanding multi-million dollar ransoms.
Like other ransomware operators, Mount Locker started targeting corporate networks, it has been active since the end of July 2020.
“From ransom notes shared with BleepingComputer by victims, the Mount Locker gang is demanding multi-million dollar ransom payments in some cases.” reported BleepingComputer.
Mount Locker ransom note (Source BleepingComputer)
In one of the attacks attributed to the group, the gang stole 400 GB of data from the victim and threatened it to share them with the its competitors, the media outlets, and TV channels, if the ransom is not paid.
The victim decided to not pay the ransom and the group published its data on its data leak site.
Currently, the data leak site includes the name of other alleged victims, and for one of them, it contained the leaked files.
Recently the ransomware operators claimed to have stolen the files from ThyssenKrupp System Engineering, from security company Gunnebo, and the provider of Nitonol components Memry, and Makalot.
#MountLocker #Ransomware claimed Gunnebo as a victim and claimed to steal source code, HR, and financial data
Gunnebo, founded in 1764 in Sweden, is a security company specializing in security products, services, and software solutions
4k employees, $860m revenue pic.twitter.com/sCdRFZwMwz
#MountLocker claimed Memry as a victim.
Established in 1983, Memry is HQ'd in Connecticut. They provide Nitonol components including products for laser cutting, grinding and surface finishing.
$108m revenue, 400 employees pic.twitter.com/p8MNDC8hev
According to the popular malware researchers Michael Gillespie, the Mount Locker uses ChaCha20 to encrypt the files and an embedded RSA-2048 public key to encrypt the encryption key.
The malware appends the extension .ReadManual.ID to the filenames of the encrypted files.
The ransom note, named RecoveryManual.html, includes instructions on how to access a Tor site, which is a chat service, that allows victims to communicate with the ransomware operators.
Experts confirmed that the encryption process implemented by the ransomware is not affected by any flaw, this means that it is not possible to recover the victims’ files for free.
(SecurityAffairs – hacking, ransomware)
Bengali (Bangladesh) · 
English (United States) ·