Ransomware group profile · #85 by claimed victims

Quantum ransomware

Quantum ransomware, active from mid-2021 through 2022, was a rebrand of the MountLocker/AstroLocker/XingLocker lineage that operated as RaaS, known for extremely fast attack timelines (under four hours from initial access to encryption) and ransom demands ranging from $150,000 to multi-million dollars.

Active First seen Sep 2021

68Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

11Countries hit

35Leak-site URLs tracked, 0 online

9 Dec 2022Latest claim recorded

Victimology

Who Quantum claims to have breached, from 68 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services19

Manufacturing14

Financial Services5

Technology4

Retail & E-Commerce4

Government & Defense4

Energy & Utilities4

Agriculture and Food Production3

Top countries

United States24

Canada6

Australia3

Austria1

Netherlands1

Israel1

Qatar1

United Kingdom1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
ChemiFlex	Manufacturing	—	9 Dec 2022
Radical Sportscars	Manufacturing	—	9 Dec 2022
Orotex	Not Found	—	9 Dec 2022
Acquarius Trust Group	Financial Services	—	9 Dec 2022
Pilenpak	Other	—	9 Dec 2022
AHT Wisconsin Windows	Manufacturing	—	9 Dec 2022
Midland Cogeneration Venture	Energy & Utilities	—	13 Nov 2022
MCV Holding Company LLC	Professional Services	—	2 Nov 2022
Midland Cogeneration Venture, Michigan	Energy & Utilities	—	1 Nov 2022
Lightbank	Financial Services	—	23 Oct 2022
Rosenblatt Securities	Financial Services	—	19 Oct 2022
Instituto Agrario Dominicano	Agriculture and Food Production	DO	2 Sep 2022

All 68 Quantum victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Quantum is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Quantum ransomware still active?

Quantum is tracked as active. The most recent leak-site claim VULONE recorded is dated 9 December 2022.

How many victims has Quantum claimed?

VULONE has recorded 68 leak-site victim claims attributed to Quantum since September 2021, across 11 countries and 14 sectors.

Which industries does Quantum target?

The sectors most often named on the Quantum leak site are Professional Services, Manufacturing, Financial Services.

Which countries are most affected by Quantum?

Most Quantum victims recorded by VULONE are located in United States, Canada, Australia.

Where does VULONE get Quantum victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].