Mallox ransomware: in-depth analysis and evolution


Mallox is a sophisticated and dangerous family of malicious software that has been causing significant damage to organizations worldwide.

In 2023, this ransomware strain demonstrated an uptick in attacks, the overall number of discovered Mallox samples exceeding 700. In the first half of 2024, the malware was still being actively developed, with new versions being released several times a month, while the Mallox RaaS affiliate program advertised on dark web forums was seeking new partners. This article aims to provide a comprehensive technical overview of the ransomware and its history.

Read more…
Source: Kaspersky


Sign up for our Newsletter


Related:

  • Boeing confirms ransomware attack as stolen data released by cybercrime gang Lockbit

    November 11, 2023

    Stolen data from American aircraft manufacturer Boeing has been released online by the cybercrime gang, Lockbit, according to the group’s website. Boeing confirmed a cybersecurity incident involving elements of its parts and distribution business. “We are aware that, in connection with this incident, a criminal ransomware actor has released information it alleges to have taken from ...

  • DP World Australia’s port operations hit by cyber attack

    November 11, 2023

    Global ports operator DP World Australia has restricted access to its ports as it works to contain a cyber security incident that is likely to disrupt the movement of goods for days. DP World Australia detected the incident and began responding on Friday, it said in a statement. DP World Australia, part of Dubai’s state-owned ports giant ...

  • Cerber Ransomware Exploits Atlassian Confluence Vulnerability CVE-2023-22518

    November 10, 2023

    On October 31, 2023, Atlassian published an advisory on CVE-2023-22518, an Improper authorization vulnerability involving the Confluence Data Center and Server. Initially reported to cause data loss, it was eventually revealed that exploiting this vulnerability allows unauthorized users to reset and create a Confluence instance administrator account, allowing them to perform all admin privileges available to ...

  • YouTube shows ads for ad blocker, financial scams

    November 10, 2023

    After performing local experiments for a few months, YouTube recently expanded its effort to block ad blockers. The move was immediately unpopular with some users, and raised some questions in Europe about whether it was breaking privacy laws. In addition, there are some still some fundamental issues that have some people concerned. In this blog post, ...

  • Maine government says data breach affects 1.3 million people

    November 10, 2023

    The government of Maine has confirmed over a million individuals had personal information stolen in a data breach earlier this year by a Russia-linked ransomware gang. In a statement published Thursday, the Maine government said hackers exploited a vulnerability in its MOVEit file-transfer system, which stored sensitive data on state residents. The hackers used the vulnerability ...

  • U.S. arm of China mega-lender ICBC hit by ransomware attack

    November 10, 2023

    The U.S. arm of China’s largest bank said Thursday that it was hit by a ransomware attack, forcing clients to reroute trades and disrupting the U.S. Treasury market. Ransomware attacks typically access vulnerable computer systems and encrypt or steal data, before sending a ransom note demanding payment in exchange for decrypting the data or not releasing ...