Mallox is a financially motivated ransomware group that first emerged in May 2021, with initial activity recorded in June of the same year. The group, also known by aliases such as TargetCompany, Fargo, and Tohnichi, initially conducted direct attacks before evolving to incorporate phishing campaigns and adopting a Ransomware-as-a-Service (RaaS) model by 2022. Mallox is assessed with moderate confidence to have ties to Russian-speaking individuals or groups. A defining characteristic of Mallox is its consistent exploitation of unsecured Microsoft SQL (MS-SQL) servers as a primary initial access vector, distinguishing it from many other ransomware operations. The group operates a double extortion model, stealing data before encryption and threatening its publication to compel victims into paying a ransom. Mallox has been one of the longest-running ransomware groups to remain active, continuously developing new versions of its malware and expanding its attack surface, notably to Linux an

Aliases del actor

MalloxTohnichiWater GatpanapunFARGO

Actores similares

blackwaterransomware · 11clearwateractor · 1Malloxactor · 1MuddyWaterapt · 1malloxransomware · 1muddywateractor · 1Water Labbuapt · 0Water Gamayunapt · 0Water Saciapt · 0Water Barghestapt · 0