Mallox Ransomware

Mallox ransomware, also identified by names such as Fargo, TargetCompany, and Tohnichi, is a significant and evolving threat in the cybersecurity landscape. Operating as a Ransomware-as-a-Service (RaaS), Mallox has been active since June 2021, showcasing continuous development and an increasing number of detected samples. This article provides a comprehensive technical overview of Mallox, tracing its history, detailing its operational methods, analyzing its complex encryption schemes, and outlining effective defense strategies. The primary goal is to equip security professionals with the necessary knowledge to combat this persistent and adaptive threat.

Origins & Evolution

Mallox ransomware's origins trace back to June 2021, initially characterized by attacks targeting specific organizations. Early variants exhibited unique naming conventions, with samples tailored to victims using distinct file extensions such as .architek, .avast, .bitenc, .exploit,.FARGO2, .FARGO3, .xollam and appending the victim’s names as the extension. This period marked its emergence as a targeted threat, focusing on bespoke attacks.

A significant shift occurred around 2022, potentially indicating a change in ownership or operational strategy. The ransomware adopted the more generic "Mallox" branding and began to be offered under a Ransomware-as-a-Service (RaaS) model. This transition was marked by advertisements on dark web forums, such as RAMP, seeking experienced affiliates. This period marked the beginning of multi-extortion techniques, with operators threatening to publish stolen victim data.

Since 2022 the RaaS is using affiliate IDs hardcoded in the trojan's body and reported to C&C via the HTTP parameter "user=".

Interviews with individuals claiming to be associated with Mallox have provided further insights, although the veracity of these claims remains subject to scrutiny. These interviews suggest a focus on targeting larger, wealthier organizations and a preference for working with experienced penetration testers. Learn about ethical hacking for free.

Tactics & Techniques

Mallox ransomware employs a sophisticated multi-stage attack chain, leveraging a combination of techniques to compromise, persist, and ultimately encrypt victim data.

* Disabling Windows Recovery Environment: Commands like bcdedit /set {default} bootstatuspolicy ignoreallfailures and bcdedit /set {default} recoveryenabled no are used to prevent system recovery.

* Deletion of Shadow Copies: vssadmin delete shadows /all /quiet is executed to eliminate shadow copies, preventing data restoration.

* Stopping and removing SQL-related services:

* Clearing application, security, setup, and system event logs:

* Modifies file permissions using commands like: takeown.exe, cmd.exe, icacls.exe, etc.

* Termination of Specific Processes: The ransomware terminates processes associated with security software, databases, and other applications that might interfere with encryption.

* Bypasses Raccine: If Raccine anti-ransomware is present, it deletes its registry key to bypass it. Understanding Windows Registry.

* Original Version: Used Elliptic Curve Cryptography (ECC) for key generation, Elliptic-curve Diffie–Hellman (ECDH) for key agreement, and ChaCha20 for data encryption. A "technical buffer" was used to store cryptographic information.

* Recent Versions: Shifted to using master public keys, CTR_DRBG for key generation, and AES-256 in GCM mode for encryption. The technical buffer structure has been expanded. The vulnerability in using RtlGenRandom was fix in v1F.

* Drive Enumeration: Mallox enumerates drives and excludes specific folders and file extensions from encryption to maintain system stability.

Targets or Victimology

Mallox ransomware's targeting strategy is characterized by a focus on financial gain and, potentially, geopolitical motivations.

Attack Campaigns

Mallox ransomware has been linked to several notable attack campaigns:

Defenses

Protecting against Mallox ransomware requires a multi-layered approach, focusing on prevention, detection, and response:

* Monitor for PowerShell or Cmd.exe downloading data with "IWR" or "Invoke-WebRequest" and "DownloadData".

* Monitor command-line activity for vssadmin deleting shadows or PowerShell using Get-WmiObject Win32_Shadowcopy | ForEach-Object ($_.Delete();).

* Detect suspicious data exfiltration and ransomware-like file encryption patterns.

Conclusion

Mallox ransomware represents a persistent and evolving threat, driven by a financially motivated RaaS model. Its sophisticated attack techniques, including the exploitation of MS-SQL server vulnerabilities, multi-stage payload delivery, and advanced encryption schemes, require organizations to implement robust, multi-layered defenses. Continuous monitoring, proactive threat hunting, and a strong focus on security fundamentals, such as patching and secure remote access, are crucial for mitigating the risk posed by Mallox and other similar ransomware threats. The ongoing development of new variants, including a Linux version, underscores the need for constant vigilance and adaptation in the face of this evolving threat landscape.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles: