Quantum Locker
Quantum Locker is a ransomware payload referenced in reporting on the financially motivated threat actor Vanilla Tempest, also known as Vice Society/VICE SPIDER. The malware is described in the provided content only as one of several ransomware families that this actor has deployed over time, alongside BlackCat, Zeppelin, Rhysida, and in some reporting Hello Kitty/Five Hands. Vanilla Tempest has been active since at least 2021 or 2022 and has frequently targeted organizations in the education, healthcare, IT, and manufacturing sectors. The content also notes a prior case in which deployment of the Atera agent and Splashtop Streamer on a compromised system resulted in Quantum Locker ransomware being deployed. Beyond these associations, the provided material does not include high-confidence technical details on Quantum Locker’s internal functionality, encryption behavior, ransom notes, infection vector specific to the malware itself, or distinct indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“The only other case that we identified using this version of Atera agent and an installation of Splashtop Streamer resulted in the deployment of Quantum Locker ransomware.”
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Vice Society was observed deploying INC ransomware against the health care industry; this group has a long-standing habit of cycling through third-party payloads such as BlackCat, Rhysida, Hello Kitty, Zeppelin, and Quantum Locker.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware family referenced as one of the third-party payloads used by Vice Society.
Ransomware family referenced as previously deployed by Vanilla Tempest (no technical details provided in the content).
Ransomware payload used by the threat actor in addition to other ransomware families.
Ransomware strain attributed in the content as one of multiple families delivered by Vanilla Tempest over time.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.