TargetCompanyMalware
- Fargo
- Mallox
- tohnichi
This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this malware is dated to mid-June 2021. The extension of the encrypted files are set to the compromised company:. A decryptor was released on 2022-02-07 by AVASTFrom MISP Galaxy
Last reported 18 days ago, by Infosecurity Magazine5 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1014Rootkit
“SIXZUT and JITTERLY: Newly launched security firm VirLabs looks at SIXZUT and JITTERLY, a Linux implant and a rootkit that are being planted by the Red Heron group on Gitea servers.”
- T1053.005Scheduled Task
“The phishing emails are delivering malicious archive files that use virtual hard disks to create scheduled tasks that periodically run the group's malware.”
- T1059.003Windows Command Shell
“The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution.”
- T1110Brute Force
“Sekoia TDR observed an MS-SQL honeypot compromised by brute force within an hour, then used to deploy Mallox ransomware via PureCrypter.”
- T1176.001Browser Extensions
“Malicious browser extensions: Security researchers have discovered a cluster of more than 30 malicious Chrome extensions posing as financial advice tools.”
- T1490Inhibit System Recovery
“Mallox use bcedit to inhibit system recovery.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities“…Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo.”
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“PS5 Relapse: Software developer Nathan Fargo has released Relapse, an exploit to jailbreak recent versions of the PS5 firmware.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…o destacó como el único país de la región donde se registraron señales de grupos como DarkSide, Cl0p, Mallox, Nemty, Kasseika y Avaddon, confirmando que las organizaciones locales enfrentan una diversidad de actores dirigidos significativamente…”
-
Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks“Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks”
-
Gustuff: Weapon of Mass Infection“…otentially target users of mobile Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase etc.”
Indicators in its reports
named in the reports above- hxxp://91.215.85[.]142/QWEwqdsvsf/ap.phpin 1 report
- 91.215.85[.]142in 1 report
- hxxps://whyers[.]ioin 1 report
- whyers[.]ioin 1 report
- hxxps://www.isxhost[.]uk/in 1 report
- www.isxhost[.]ukin 1 report
- records[.]phin 1 report
- ailistiterator[.]nextin 1 report
- proxyconfigclass[.]hostin 1 report
- kevinhardiman.bsky[.]socialin 1 report
- kevincollier.bsky[.]socialin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.