Mallox

Mallox is a potent and evolving malware, first identified in 2021, that operates primarily as ransomware. It infiltrates networks predominantly via SQL servers, encrypts victims' files, and appends various extensions such as .ma1x0, .cookieshelper, and .karsovrop. Upon successful encryption, Mallox drops a ransom note typically named "HOW TO BACK FILES.txt", "HOW TO RESTORE FILES.txt", "RECOVERY INFORMATION.txt", or "FILE RECOVERY.txt". The malware has been tracked by several cybersecurity organizations, including PCrisk and Unit 42, who have observed its continued development and spread. The distribution of Mallox attacks is global, with no specific geographical limitations. According to data from Kaspersky Security Network (KSN), the affiliates of the Ransomware-as-a-Service (RaaS) do not restrict their activities to any particular country but aim to exploit vulnerable companies wherever they are located. For promotion and increased visibility, the threat actors behind Mallox maintain an account on platform X, where they regularly post updates about new victims and share links to download portions of stolen data. The Mallox ransomware also operates a data leak site, residing on the same domain as the negotiation portal, which lists victim companies. This tactic increases pressure on victims to pay the ransom, as it threatens public exposure of sensitive data. Understanding the nature and operation of the Mallox ransomware is crucial for implementing appropriate security measures. By doing so, companies and organizations can better protect their digital assets and reduce the risk of falling victim to this malicious software.