Skip to main content
Darkfield

Operator dossier

Malas is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 170 public victims claimed by this operator between April 9, 2023 and May 18, 2023. **Overview**: Malas is a ransomware group that emerged in April 2023, operating with primarily financial motivations and targeting organizations across multiple sectors and geographic regions. The group has demonstrated significant activity levels, compromising approximately 170 victims within its first operational period. **Origin & Affiliation**: Public documentation regarding Malas' specific country of origin and operational structure remains limited in available CISA, FBI, and security researcher reports. The group's targeting patterns across both Western nations and Russia suggest either independent operations or a complex operational structure that crosses traditional geopolitical boundaries. **Attack Methodology**: Detailed technical analysis of Malas' specific attack vectors, tools, and encryption methods has not been extensively documented in publicly available threat intelligence reports from major security organizations. Based on victim distribution patterns, the group appears to employ effective initial access techniques that enable them to successfully compromise diverse organizational targets across multiple countries and industry sectors. **Notable Campaigns**: While Malas has accumulated a substantial victim count of 170 organizations, specific high-profile attacks or record ransom demands have not been prominently featured in public security advisories or law enforcement communications. The group's targeting of media, technology, manufacturing, and transportation sectors across Italy, Russia, Germany, France, and the United States indicates a broad operational scope. **Current Status**: Given the limited public documentation available from authoritative sources, the current operational status of Malas remains unclear based on verified threat intelligence reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by Malas

Most recent 150 of 170 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Malas →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Malas

170 victims indexed · first seen 3 years ago · last activity 3 years ago

170
Victims indexed
#53 of 364 tracked operators
1m
Active period
Apr 2023 → May 2023
17
Countries hit
top Russia · 39

At a glance

Status
inactive
First seen
3 years ago
Last activity
3 years ago
Onion sites
2 known endpoints
Primary sector
Technology · 51 hits

About

**Overview**: Malas is a ransomware group that emerged in April 2023, operating with primarily financial motivations and targeting organizations across multiple sectors and geographic regions. The group has demonstrated significant activity levels, compromising approximately 170 victims within its first operational period. **Origin & Affiliation**: Public documentation regarding Malas' specific country of origin and operational structure remains limited in available CISA, FBI, and security researcher reports. The group's targeting patterns across both Western nations and Russia suggest either independent operations or a complex operational structure that crosses traditional geopolitical boundaries. **Attack Methodology**: Detailed technical analysis of Malas' specific attack vectors, tools, and encryption methods has not been extensively documented in publicly available threat intelligence reports from major security organizations. Based on victim distribution patterns, the group appears to employ effective initial access techniques that enable them to successfully compromise diverse organizational targets across multiple countries and industry sectors. **Notable Campaigns**: While Malas has accumulated a substantial victim count of 170 organizations, specific high-profile attacks or record ransom demands have not been prominently featured in public security advisories or law enforcement communications. The group's targeting of media, technology, manufacturing, and transportation sectors across Italy, Russia, Germany, France, and the United States indicates a broad operational scope. **Current Status**: Given the limited public documentation available from authoritative sources, the current operational status of Malas remains unclear based on verified threat intelligence reporting.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

2 months
2023-04-01T00:00:00+00:00 · 1682023-05-01T00:00:00+00:00 · 2
2023-04-01T00:00:00+00:002023-05-01T00:00:00+00:00

Top countries

🇷🇺 Russia
39
🇮🇹 Italy
33
🇺🇸 United States
15
🇩🇪 Germany
11
🇪🇸 Spain
7
🇫🇷 France
6
🇬🇧 United Kingdom
5
🇮🇩 Indonesia
2
Russia dossier →Italy dossier →United States dossier →Germany dossier →

Top sectors

Technology
51
Manufacturing
25
Business Services
20
Retail & Consumer
8
Media
7
Financial Services
6
Construction
6
Hospitality
5
Technology dossier →Manufacturing dossier →Business Services dossier →Retail & Consumer dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion
  • http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion/posts/

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Malas posts a victim.

Add Malas to your watchlist — Pro pings you within 5 minutes of any new Malas leak-site post, Telegram callout, or affiliate-rebrand inference.