Ankura CTIX FLASH Update - July 25, 2023

Malware Activity

"Mallox" Ransomware Increases Activity in 2023 by 174%

Researchers have published a new report on the "Mallox" ransomware, which has had a 174% increase in activity compared to the second half of 2022. Mallox (otherwise known as "TargetCompany" and "FARGO") has been active since June 2021 and typically targets Microsoft Windows systems by exploiting unsecured Microsoft SQL servers. Mallox has historically targeted organizations in various industries around the globe, with a majority involved in "manufacturing, professional and legal services, and wholesale and retail." Researchers detailed that the ransomware has been utilizing dictionary brute force attacks (using a list of common passwords against their target), data exfiltration, and network scanners in their recent campaign. Mallox uses double extortion techniques, which consist of exfiltrating data prior to encrypting files on the victim machine and threatening to publish the data on their