Mallox ransomware has become a major threat. Learn its evolution from targeted attack to RaaS, attack vectors, and how to protect your organization.
The rapid proliferation and increased sophistication of Mallox ransomware signals a pressing demand for organizations to urgently bolster their defenses, protecting their digital assets and mitigating risks. To address this need, Kaspersky has released a report titled “Mallox Ransomware: In-Depth Analysis and Evolution.” The new publication comprehensively analyzes the Mallox ransomware, chronicling its transformation from a privately operated malware to a full-scale ransomware-as-a-service (RaaS) operation.
The report highlights Mallox’s significant impact since its initial appearance in early 2021. Originally a highly targeted, human-operated ransomware, Mallox severely damaged organizations worldwide. Kaspersky’s research details how this once-isolated threat has rapidly evolved, with more than 700 new samples identified from 2021 to mid-2024. This surge in activity is largely attributed to Mallox’s transition into a RaaS model, enabling it to expand aggressively by recruiting affiliates and partners through a dark web forum.
In January 2023, the operators behind Mallox launched a robust RaaS affiliate program, actively seeking skilled “pentesters” to expand their reach. Offering lucrative profit-sharing terms, the program has attracted a host of cybercriminals, contributing to a marked increase in Mallox-related attacks. The report further delves into the advancements in Mallox’s encryption schemes, which have become increasingly sophisticated. Kaspersky’s detailed analysis of these cryptographic techniques underscores the continuous innovation by Mallox developers to enhance the ransomware’s efficacy.
Also Read: Beware of Juice Jacking: Protecting Your Devices
The report also illuminates Mallox’s global spread, focusing on its preferred infection vectors. Attackers often exploit vulnerabilities in MS SQL and PostgreSQL servers, demonstrating their adaptability and threat to various industries. This in-depth analysis serves as an essential resource for cybersecurity professionals, offering critical insights into the nature and evolution of this formidable ransomware.
Mallox has demonstrated a particular preference for targeting certain regions. Brazil, Vietnam, and China have emerged as the most frequently targeted countries. Although India, Russia, Saudi Arabia, Lebanon, Colombia, Turkiye, and the United States of America have experienced fewer attacks, they remain vulnerable to the ransomware’s threat.
“Understanding the Mallox ransomware – its evolution, characteristics, and devastating potential – empowers organizations to fortify their defenses. With the right security measures in place, companies can protect their digital assets and diminish the risk of becoming the next target of this formidable threat,” comments Kaspersky security expert Fedor Sinitsyn.
Also Read: Beyond the Hype: The Real Impact of Industry 4.0
To maximize your organization’s security, Kaspersky recommends:
- Do not expose remote desktop services, such as RDP, to public networks unless absolutely necessary, and always use strong passwords.
- Make sure your commercial VPN and other server-side software solutions are always up to date. Exploiting this type of software is a common vector of ransomware infection. Also, always keep client-side applications up to date.
- Use complex security solutions, combining endpoint protection and automated incident response features, such as award-winning Kaspersky NEXT.
- Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminal connections.
- Back up data regularly. Make sure you can quickly access it in an emergency.
- Use the latest Threat Intelligence information to stay current on the latest TTPs used by threat actors.
- Use Managed Detection and Response services to help identify and stop an attack in the early stages before the attackers achieve their ultimate goals.
- Educate your employees to protect the corporate environment. Dedicated training courses like those in the Kaspersky Automated Security Awareness Platform can help.
Please read the full report on Mallox ransomware evolution on Securelist.com.
