mallox

Executive Summary

The mallox threat actor is a medium-sophistication criminal group primarily involved in ransomware activities, targeting organizations for financial gain. Known since November 2022, this actor has demonstrated the ability to compromise victim systems through a combination of advanced cryptographic methods and targeted campaigns.

Goals & Targeting

Millox's primary objectives are financial gain through ransom payments and organizational disruption. They typically target mid-sized businesses across various sectors, focusing on regions where ransom支付 demands are feasible without attracting excessive law enforcement attention.

Millox is a ransomware operator characterized by their use of multiple encryption algorithms, including ChaCha20, AES-128, and Curve25519. The group's activity has been tracked from mid-2021, with their first confirmed operations beginning in 2022. Mallox targets businesses across various sectors, encrypting files and appending extensions related to the compromised company. Their operational timeline extends through July 2024, indicating sustained ransomware distribution efforts. The group has demonstrated a focus on negotiation tactics, leveraging victims' need for data recovery to extract ransoms. Known victims number 49, with associated phishing campaigns and encrypted file patterns.

Key Capabilities

• Ransomware deployment
• Advanced encryption techniques
• Spear-phishing campaigns
• Negotiation tactics
• Data exfiltration

Software / Tooling

Campaigns & Victims

Millox has been active since mid-2021, with confirmed operations from November 2022 to July 2024. Their campaigns typically involve targeted phishing attempts, encrypted file exfiltration, and structured negotiations. Notable patterns include the use of .<target_company> file extensions for encrypted files and potential DDoS threats if ransoms are not paid.

IOC Patterns

• Phishing emails with malicious attachments
• Encrypted files with company-specific extensions
• Network traffic anomalies during encryption

Recommended Actions

• Implement strict phishing email filters
• Segment networks to limit lateral movement
• Monitor for encrypted file patterns
• Establish incident response plans for ransomware events

Suggested Tags