Mallox

Mallox is a potent malware that has been causing significant disruption in the digital world. This ransomware, primarily infiltrating networks via SQL servers, has shown its ability to adapt and evolve over time. PCrisk has identified new variants of Mallox that append extensions such as .ma1x0, .cookieshelper, and .karsovrop, each dropping a unique ransom note on the victim's system. SentinelLabs further explains the complex nature of this malware, describing it as a part of a "complex menagerie of cross-pollinated toolsets and non-linear codebases," indicating the intricate and evolving landscape of ransomware threats. The Mallox ransomware group has adopted Kryptina, a Ransomware-as-a-Service (RaaS) tool initially available for free on dark web forums. In an interesting development, a Mallox affiliate updated Kryptina’s source code and documentation, translating it into Russian and adjusting branding but leaving encryption routines largely intact. This resulted in a variant known as “Mallox v1.0,” which uses AES-256 encryption with minor changes to the original code. It retains the core functionality of Kryptina while removing its branding, signaling the commoditization of ransomware tools in the cybercrime market. However, the group faced a setback in May 2024 when a Mallox affiliate leaked server data, revealing the use of a modified version of Kryptina to power Linux-based ransomware attacks. Despite this, Mallox remains a serious threat to enterprises. By understanding the nature and evolution of Mallox ransomware, organizations can implement appropriate security measures to safeguard their digital assets and minimize the risk of falling victim to this malicious software.