Ransomware Group intelligence
Quantum
InactiveTrack Quantum with 68 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Quantum is tracked by Breach House as a ransomware group with 68 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 1h ago | quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion |
| Leak location 2 | Onion service | Down checked 1h ago | 22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion |
Top Activity Sectors (14)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Quantum, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: quantum executes PowerShell scripts to spread payloads and disable security tools across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: quantum leverages registry run keys to maintain persistence by automatically launching malware on reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: quantum disables antivirus and monitoring tools using registry modifications and service interference to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: quantum deletes Volume Shadow Copies and backup files via command-line utilities to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: quantum uses network share discovery to locate victim file shares for lateral movement and data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: quantum moves laterally through SMB/Windows Admin Shares to access additional systems within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: quantum encrypts victim files using its ransomware payload, targeting documents and business data for impact.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: quantum calls system recovery inhibitors to block backup restoration and increase operational impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Tools Observed (12)
▼Software Quantum has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
ProcDump
Discovery & enumeration
AdFind
Exfiltration
MEGA
RClone
LOLBAS (living-off-the-land binaries)
PsExec
WMIC
Offensive security tooling
Cobalt Strike
Remote monitoring & management
AnyDesk
Atera
RSAT
Splashtop
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Crypto Wallets (1)
▼
$395,459
Received (USD)
1
Payments
1
Known wallets
$395,459
Largest single payment
2022-06-07 → 2022-06-07
Payment window
bitcoin · 1
| Address | Chain | Received (USD) | Payments |
|---|---|---|---|
bc1qenh0h6vvm00krm5re7ycst98unulgp4x04dn2u |
bitcoin | $395,459 | 1 |
Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
Victims (68)
Search, filter and paginate the victim timeline for Quantum. Showing 1–68 of 68.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | ChemiFlex id4766 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Radical Sportscars id4765 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Orotex id4764 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Acquarius Trust Group id4763 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Pilenpak id4762 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | AHT Wisconsin Windows id4761 View details | Energy | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Midland Cogeneration Venture id4571 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | MCV Holding Company LLC id4439 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Midland Cogeneration Venture, Michigan id4430 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Lightbank id4370 View details | Finance / Legal / Insurance | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Rosenblatt Securities id4364 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Instituto Agrario Dominicano id4071 View details | Dominican Republic | Communication / Marketing | — | |
|
The Dominican Agrarian Institute is a decentralized government agency under the Ministry of Agriculture,established by Law No. 5879 as of April 27, 1962, with the aim of carrying out agrarian reform programs throughout the national geography by seizing and distributing land to peasants to transform the structure and agricultural production, improving living conditions in a Dominican villages. |
|||||
| Ransomware | Moscone Center id4068 View details | United States | Other | — | |
|
Founded in 1981. Moscone Center is headquartered in San Fransisco, California. Moscone Center is a meeting and exhibition facility |
|||||
| Ransomware | Moskowitz, Mandell & Salim, P.A. id3990 View details | United States | Finance / Legal / Insurance | — | |
|
Moskowitz, Mandell & Salim, P.A. was established in 1985 and provides legal services in areas of governmental approval, commercial real estate, zoning and land use, corporate transactional law, estate planning, and community association law with emphasis on complex commercial litigation. ​ |
|||||
| Ransomware | Shaw & Slavsky id3971 View details | United States | Retail / E-commerce | — | |
|
Shaw & Slavsky was founded in 1932 as a manufacturer of POP signs for grocery retailers. Since our inception, we have provided innovative signage and merchandising solutions for retailers. We have over 100,000 square feet of manufacturing capacity to build stock and custom signage and fixtures. |
|||||
| Ransomware | Freyr Solutions id3934 View details | United States | Services | — | |
|
Freyr is one of the largest, global, Regulatory-focused solutions and services companies for the Life Sciences industry supporting, Large, Medium, and Small size global Life sciences companies (Pharmaceutical | Generics | Medical Device | Biotechnology | Biosimilar | Consumer Healthcare | Cosmetics | Food and Food Supplements | Chemicals) in their entire Regulatory value-chain; ranging from Regulatory Strategy, Intelligence, Dossiers, Submissions, etc. to Post-approval/Legacy Product Maintenance, Labeling, Artwork Change Management, and other related functions |
|||||
| Ransomware | Liftow LTD id3905 View details | Canada | Manufacturing / Engineering | — | |
|
Founded in 1960, Liftow is a Toyota forklift dealer group in North America. They offer new and pre-owned inventory of forklifts as well as parts and services. |
|||||
| Ransomware | BEESENSE id3904 View details | Israel | Construction / Real Estate | — | |
|
BeeSense designs, develops and manufactures advanced, unique, multi-sensor technology-based solutions and independent, wireless communication & power infrastructures for intelligence, surveillance and reconnaissance in the homeland security and defense sectors. |
|||||
| Ransomware | Delon Hampton & Associates, Chartered id3814 View details | United States | Manufacturing / Engineering | — | |
|
In January 1973, Delon Hampton and Associates, Chartered was founded with the sole objective of creating a world-class engineering consulting firm specializing |
|||||
| Ransomware | Autohaus id3813 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Broshuis | Driving innovation id3812 View details | United States | Other | — | |
|
Broshuis B.V. is a 100% family owned, Dutch company and one of the largest specialty trailer manufacturers in Europe. |
|||||
| Ransomware | ZEUS Scientific id3788 View details | United States | Healthcare / Pharma | — | |
|
This company provides medical testing equipment and diagnostic services. |
|||||
| Ransomware | American International Industries id3767 View details | United States | Communication / Marketing | — | |
|
Founded in 1971, American International Industries is a manufacturer and distributor of beauty and skin care products. |
|||||
| Ransomware | Crupi Group id3701 View details | Canada | Manufacturing / Engineering | — | |
|
The Crupi Group is an assembly of companies surrounding D. Crupi and Sons Ltd. to fulfill paving and road construction needs for developers, municipalities |
|||||
| Ransomware | Avante Health Solutions id3699 View details | United States | Healthcare / Pharma | — | |
|
Avante Health Solutions is a single source provider of medical, surgical, diagnostic imaging, and radiation oncology equipment, including sales, service, repair, parts, refurbishing, and installation. Avante is making it easier and more affordable for every hospital, clinic, and medical practice to have the very best equipment, supplies and service. |
|||||
| Ransomware | RG Alliance Group id3649 View details | United States | Services | — | |
|
R.G. Alliance is an Outsourced Financial Consulting firm based in San Diego, California. It provides services to businesses of all sizes and stages of growth. |
|||||
| Ransomware | Shred Station id3636 View details | United Kingdom | Services | — | |
|
Shred Station understand that secure destruction of your confidential &/or sensitive documents is a serious business - hence we offer the very best in high security shredding services. |
|||||
| Ransomware | YMCA id3635 View details | United States | Healthcare / Pharma | — | |
|
YMCA of South Florida has been dedicated to building healthy, confident and secure children, families and communities. |
|||||
| Ransomware | M. Green and Company LLP id3634 View details | United States | Public Sector | — | |
|
Certified Public Accountants |
|||||
| Ransomware | Medlab Pathology id3633 View details | Australia | Communication / Marketing | — | |
|
Medlab Pathology is one of Australia's largest, privately owned independent pathology practices |
|||||
| Ransomware | Florida Department of Veterans' Affairs id3547 View details | United States | Public Sector | — | |
|
Connecting veterans to federal and state benefits they have earned. |
|||||
| Ransomware | Active Communications International id3511 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Transsion Holdings id3510 View details | China | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | Eurocept id3509 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tex-Isle Supply id3461 View details | United States | Manufacturing / Engineering | — | |
|
Tex-Isle Supply, Inc. is a leading distributor of high quality energy tubulars, with value-added manufacturing and processing capabilities |
|||||
| Ransomware | Hirsch Watch Straps & Accessories id3455 View details | Austria | IT | — | |
|
HIRSCH develops and manufactures the most advanced, the most detailed and the finest bracelets in the world. HIRSCH bracelets are the most beautiful outfit for any watch and are eagerly sought-after accessories. In addition to durability, wearing comfort and appealing looks we bring the technical functionality of these smart companions of watches to perfection. |
|||||
| Ransomware | InnPower id3454 View details | Energy | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Valley Rentals id3330 View details | Netherlands | Construction / Real Estate | — | |
|
real estate investment company |
|||||
| Ransomware | Hufcor id3329 View details | United States | Other | — | |
|
Movable glass wall company |
|||||
| Ransomware | Grosvenor Engineering Group id3328 View details | Australia | Manufacturing / Engineering | — | |
|
Building services partner in Australia and New Zealand |
|||||
| Ransomware | Drive Products id3327 View details | Canada | Communication / Marketing | — | |
|
Drive Products now offers a complete range of truck mounted equipment, products, services and solutions through a growing branch and partner network across Canada |
|||||
| Ransomware | Petro Serve id3326 View details | Qatar | Agriculture / Food | — | |
|
Largest supplier of home heating, commercial and agricultural fuel, and propane and lubricating oil |
|||||
| Ransomware | Henry id3325 View details | United States | Construction / Real Estate | — | |
|
Henry Company is an innovator of building envelope systems and develops integrated air/vapor barrier, roofing and waterproofing systems |
|||||
| Ransomware | Tehama County Social Services id3300 View details | United States | Public Sector | — | |
|
Tehama County in California |
|||||
| Ransomware | Elgin County id3291 View details | Canada | Public Sector | — | |
|
Elgin County was founded in 1852 and is a county of the Canadian province of Ontario |
|||||
| Ransomware | Confcommercio - Alessandria - Home id3276 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Camden City School District id3213 View details | United States | Education | — | |
|
Camden City School District |
|||||
| Ransomware | JetStar id3146 View details | Australia | Transportation / Travel / Logistics | — | |
|
JetStar is an Australian low-cost airline that offers multiple flights at very low costs. |
|||||
| Ransomware | Hi Tech HoneyComb id3145 View details | United States | IT | — | |
|
Hi Tech Honeycomb Inc. is a leading manufacturer and supplier of honeycomb detail for gas turbine engine seals. |
|||||
| Ransomware | Service Employees' International Union id3144 View details | United States | Communication / Marketing | — | |
|
SEIU represents approximately 100,000 members. SEIU represents members who work for school boards, home care agencies, hospitals, special care homes, retirement homes, emergency services, social services, and municipalities, among many others |
|||||
| Ransomware | Broadleaf id3141 View details | United States | Agriculture / Food | — | |
|
Broadleaf is a family owned food distribution company supplying the highest quality meat and specialty foods to distributors and retailers across the |
|||||
| Ransomware | Wolfe Industrial id3138 View details | United States | Manufacturing / Engineering | — | |
|
This diversity of services gives Wolfe the capability to handle a variety of projects related to material handling, air handling, custom conveyors and so on |
|||||
| Ransomware | InfoTek Consulting Services id2746 View details | Canada | Services | — | |
|
Headquartered in Toronto and conducting business all over the US and Canada and doing business for over twenty years, our dedication and staff make us one of the leading IT consulting firms in North America |
|||||
| Ransomware | Jazeera Airways id2601 View details | Kuwait | Transportation / Travel / Logistics | — | |
|
Jazeera Airways K.S.C is a Kuwaiti airline with its head office on the grounds of Kuwait International Airport. |
|||||
| Ransomware | Altoona Area School District id2539 View details | United States | Education | — | |
|
Altoona Area School District serves K-12th grade students and is located in Altoona, PA. |
|||||
| Ransomware | Lewis & Clark College id2437 View details | United States | Education | — | |
|
L&C, founded in 1970, is a two-year higher education institution with multiple campuses, a river research center, humanities center, training center |
|||||
| Ransomware | Chattanooga Chamber of Commerce id2333 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Biotique id2278 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Sodiba id2277 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | PRIDE Community Services id2132 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Zepter id2131 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Digital Workplace Services & Solutions id2129 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | The Jewelry Exchange is the Nations #1 Diamond Store. id2128 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | UABL S.A. id2048 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | </a> id1955 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | TILIA GROUP id1773 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | PVR Ltd. id1772 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Maple Lodge Farms id697 View details | Canada | Agriculture / Food | — | |
|
Founded in 1955, Maple Lodge Farms is a company that produces, processes, and markets chickens and chicken products |
|||||