Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Group Assessment: Mallox Ransomware

Summary: Mallox, also tracked as TargetCompany, FARGO and Tohnichi, is a Windows ransomware strain active since June 2021 that gains initial access by brute-forcing unsecured MS-SQL servers, then uses command line and PowerShell to download its payload. Unit 42 reports an approximately 174% increase in Mallox attacks in 2023 compared to the latter half of 2022, with the group running a double-extortion model and recruiting affiliates on the RAMP and nulled[.]to forums.

Bottom line: The group's entire entry path is a dictionary brute-force attack against internet-facing MS-SQL servers, and a 174% activity increase means more organizations are leaving that door open. Mallox claims hundreds of victims and is actively recruiting affiliates, so a successful recruitment drive would put more hands on the same playbook.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related