MountLocker
MountLocker is a ransomware group with a financial motive, tracked by Brandefense. It targets 3 sectors, including Manufacturing, and Transportation and Logistics, in the United States.
- SunRiseLocker
- AstroLocker
- Astro Locker Team
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jul 1, 2020
- Last seen
- Feb 8, 2022
- Record updated
Who They Target.
Arsenal · Malware And Tools.
- Quantum Lockermalware
- Megatool
- PrivatLabtool
Indicators Of Compromise.
TLP:AMBER+STRICT1 indicator on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout MountLocker.
MountLocker operated as a ransomware-as-a-service from July 2020, using a standard developer/affiliate revenue split and leveraging compromised RDP credentials for initial access, propagating laterally via Windows Active Directory APIs and targeting over 2,600 file extensions.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.