#mountlocker — Public Fediverse posts on home.social

Valéry Rieß-Marchive :verified: @[email protected] · 2023-10-05 · 10:02 UTC

Do you remember the #ransomchats project? Since its inception, #ransomware negotiations involving #Akira and #BlackBasta, notably, have been added. And there's more to come. 😉

https://github.com/Casualtek/Ransomchats/

But that's not all... First, Calvin So performed a comparative analysis of #ransomware chat logs and quickly brought interesting findings 👇
https://medium.com/@callyso0414/tracing-ransomware-threat-actors-through-stylometric-analysis-and-chat-log-examination-23f0f84abba8

Shortly after, he did it again only to find similarities suggesting a connection between #Conti & #MountLocker predating the #Conti & #Quantum one 🤩
https://medium.com/@callyso0414/tracing-ransomware-threat-actors-through-stylometric-analysis-and-chat-log-examination-part-2-2928cf497e5a

And that's still not all! The good folks at Sec4U also analysed the chat logs, coming up with Dos and Don'ts for #negotiation in case of #ransomware attack, stressing also that negotiating doesn't mean paying 👇
https://www.neteye-blog.com/2023/09/ransomware-negotiation-dos-and-donts/

Whatever analysis you 🫵 have performed on the #ransomchats, please share your work and findings 🙏

#ransomchats #ransomware #akira #blackbasta #conti #quantum

Valéry Rieß-Marchive :verified: @[email protected] · 2023-06-20 · 11:50 UTC

On pensait jusqu'ici qu'une des équipes de Conti était passée à Quantum au printemps 2022, à la suite de l'implosion de l'enseigne. L'analyse stylométrique de négociations de l'automne 2020, avec #MountLocker d'un côté, et Conti de l'autre, suggère qu'une équipe #Conti travaillait déjà à cette période là avec le prédécesseur de #QuantumLocker. #ransomware https://www.lemagit.fr/actualites/366542303/Ransomware-quand-MountLocker-cachait-un-Conti