Mallox

The ‎infamous‏ ‎Mallox ‎is ‎the ‎digital ‎Robin‏ ‎Hoods ‎of‏ ‎our‏ ‎time, ‎except ‎they‏ ‎steal ‎from‏ ‎everyone ‎and ‎give ‎to‏ ‎themselves.‏ ‎Since ‎mid-2021,‏ ‎they’ve ‎been‏ ‎playing ‎hide ‎and ‎seek ‎with‏ ‎unsecured‏ ‎Microsoft ‎SQL‏ ‎servers, ‎encrypting‏ ‎data, ‎and ‎then ‎graciously ‎offering‏ ‎to‏ ‎give‏ ‎it ‎back‏ ‎for ‎a‏ ‎modest ‎Bitcoin‏ ‎donation.

Mallox‏ ‎decided ‎to‏ ‎go ‎shopping ‎for ‎new ‎malware‏ ‎toys, ‎adding‏ ‎the‏ ‎Remcos ‎RAT, ‎BatCloak,‏ ‎and ‎a‏ ‎sprinkle ‎of ‎Metasploit ‎to‏ ‎their‏ ‎collection. ‎They’re‏ ‎now ‎playing‏ ‎a ‎game ‎of ‎«Catch ‎me‏ ‎if‏ ‎you ‎can»‏ ‎with ‎antivirus‏ ‎software, ‎using ‎their ‎FUD ‎obfuscator‏ ‎packers‏ ‎to‏ ‎turn ‎their‏ ‎ransomware ‎into‏ ‎the ‎digital‏ ‎equivalent‏ ‎of ‎a‏ ‎ninja.

-------

This ‎document ‎provides ‎a ‎analysis‏ ‎of ‎the‏ ‎Target‏ ‎Company ‎ransomware ‎group,‏ ‎also ‎known‏ ‎as ‎Smallpox, ‎which ‎has‏ ‎been‏ ‎rapidly ‎evolving‏ ‎since ‎its‏ ‎first ‎identification ‎in ‎June ‎2021.

The‏ ‎analysis‏ ‎delves ‎into‏ ‎various ‎aspects‏ ‎of ‎the ‎group’s ‎operations, ‎including‏ ‎its‏ ‎distinctive‏ ‎practice ‎of‏ ‎appending ‎targeted‏ ‎organizations' ‎names‏ ‎to‏ ‎encrypted ‎files,‏ ‎the ‎evolution ‎of ‎its ‎encryption‏ ‎algorithms, ‎and‏ ‎its‏ ‎tactics ‎for ‎establishing‏ ‎persistence ‎and‏ ‎evading ‎defenses.

The ‎insights ‎gained‏ ‎from‏ ‎this ‎analysis‏ ‎are ‎crucial‏ ‎for ‎informing ‎defense ‎strategies ‎and‏ ‎enhancing‏ ‎preparedness ‎against‏ ‎such ‎evolving‏ ‎cyber ‎threats.

Unpacking ‎in ‎more ‎detail