On April 25, 2022, researchers at The DFIR Report detailed the current tactics, techniques, and procedures (TTPs) of the Quantum ransomware, first discovered in August of 2021, and their recent observation of a domain-wide compromise within four (4) hours by the ransomware. The researchers detailed that the initial access vector was an IcedID payload within an iOS image delivered via a phishing email, which took two (2) hours to execute after the initial infection. Once executed, Cobalt Strike and Remote Desktop Protocol (RDP) were utilized via process hallowing and injection techniques in order to move laterally across the network. Then, Windows Management Infrastructure (WMI) and PsExec was utilized to deploy the Quantum ransomware. The entire process had a total Time-to-Ransom (TTR) of three (3) hours and forty-four (44) minutes, which the researchers noted is exceptionally short. This rapid speed, in combination with attacks of this type typically occurring during the weekend or late into the night, does not leave corporations with a large time frame to detect and respond before a total compromise occurs. The data exfiltration status was not disclosed by The DFIR Report, but BleepingComputer did note that Quantum ransomware attacks commonly exfiltrate data and “leak it in double-extortion schemes”, which involves the exfiltration of large amounts of confidential data before encrypting the victim’s files. An in-depth analysis of the observed Quantum ransomware attack as well as indicators of compromise (IOCs) can be reviewed in their posting linked below.