Quantum appeared around August 2021 and is linked to the Quantum Locker operation. The affected organisations do not fall into a single industry or country, which fits an affiliate model where the access broker decides who gets hit.
The sample
A 32-bit executable named ttsel.exe was my test case. When it runs it shows a note telling the victim to open a Tor link and quote a machine identifier. While it works it keeps a log, saved as a text file named after the payload.
payload : ttsel.exe (PE32)
cipher : Salsa20 for file contents
note : displayed on screen, links to a Tor portal, victim ID included
log : <payload name>.text written next to the executable
Network behaviour
The traffic is more interesting than the encryption. Right after launch the host sends a burst of NetBIOS name and datagram traffic (ports 137 and 138) to neighbours on the local subnet, and opens a few HTTPS connections to external addresses. That pattern is easy to spot on a segment where workstations should not talk to each other.
udp 137 local subnet name queries to neighbours
udp 138 local subnet datagram broadcasts
tcp 443 external short sessions, several destinations
Context from public reporting
Quantum was seen being deployed very quickly after an initial IcedID infection in several incident reports, sometimes within hours of first access. That compresses the window for responders.
Defensive notes
- A loader detection should be treated as ransomware precursor if the loader family is IcedID.
- Watch for workstation-to-workstation NetBIOS bursts.
- Block or alert on unexpected Salsa20 constants only as a supplementary hunting idea.