Skip to main content
Darkfield

Operator dossier

Mallox is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 49 public victims claimed by this operator between November 4, 2022 and July 15, 2024. **Overview:** Mallox is a financially motivated ransomware group that emerged in November 2022, operating as a relatively new player in the ransomware ecosystem with a focus on extracting monetary payments from victim organizations across multiple industry sectors. **Origin & Affiliation:** The group's country of origin and specific affiliations remain largely undocumented by major threat intelligence organizations, though their operational patterns suggest they operate independently rather than as part of a larger ransomware-as-a-service operation. **Attack Methodology:** Limited public documentation exists regarding Mallox's specific attack vectors and technical capabilities, though their successful compromise of 49 documented victims suggests they employ conventional ransomware deployment methods including data encryption and likely extortion tactics to pressure victims into payment. **Notable Campaigns:** Mallox has demonstrated a preference for targeting technology companies, business services, and manufacturing sectors, with their operations showing particular concentration in the United Kingdom, India, and the United States, though specific high-profile incidents have not been widely publicized by major cybersecurity firms or law enforcement agencies. **Current Status:** The group remains active as of recent threat intelligence reporting, continuing to conduct ransomware operations across their preferred geographic and sectoral targets.

Most-targeted sectors

Most-affected countries

Recent disclosures by Mallox

All 49 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Mallox →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Mallox

49 victims indexed · first seen 4 years ago · last activity 2 years ago

49
Victims indexed
#106 of 364 tracked operators
1y 8m
Active period
Nov 2022 → Jul 2024
10
Countries hit
top United Kingdom · 7

At a glance

Status
inactive
First seen
4 years ago
Last activity
2 years ago
Onion sites
2 known endpoints
Primary sector
Technology · 3 hits

About

**Overview:** Mallox is a financially motivated ransomware group that emerged in November 2022, operating as a relatively new player in the ransomware ecosystem with a focus on extracting monetary payments from victim organizations across multiple industry sectors. **Origin & Affiliation:** The group's country of origin and specific affiliations remain largely undocumented by major threat intelligence organizations, though their operational patterns suggest they operate independently rather than as part of a larger ransomware-as-a-service operation. **Attack Methodology:** Limited public documentation exists regarding Mallox's specific attack vectors and technical capabilities, though their successful compromise of 49 documented victims suggests they employ conventional ransomware deployment methods including data encryption and likely extortion tactics to pressure victims into payment. **Notable Campaigns:** Mallox has demonstrated a preference for targeting technology companies, business services, and manufacturing sectors, with their operations showing particular concentration in the United Kingdom, India, and the United States, though specific high-profile incidents have not been widely publicized by major cybersecurity firms or law enforcement agencies. **Current Status:** The group remains active as of recent threat intelligence reporting, continuing to conduct ransomware operations across their preferred geographic and sectoral targets.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

15 months
2022-11-01T00:00:00+00:00 · 42022-12-01T00:00:00+00:00 · 12023-01-01T00:00:00+00:00 · 72023-02-01T00:00:00+00:00 · 42023-03-01T00:00:00+00:00 · 32023-06-01T00:00:00+00:00 · 92023-07-01T00:00:00+00:00 · 52023-08-01T00:00:00+00:00 · 12023-09-01T00:00:00+00:00 · 12023-10-01T00:00:00+00:00 · 42024-03-01T00:00:00+00:00 · 32024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 12024-06-01T00:00:00+00:00 · 32024-07-01T00:00:00+00:00 · 2
2022-11-01T00:00:00+00:002024-07-01T00:00:00+00:00

Top countries

🇬🇧 United Kingdom
7
🇮🇳 India
4
🇺🇸 United States
3
Hong Kong SAR China
1
🇫🇷 France
1
🇲🇾 Malaysia
1
🇵🇰 Pakistan
1
🇮🇹 Italy
1
United Kingdom dossier →India dossier →United States dossier →Hong Kong SAR China dossier →

Top sectors

Technology
3
Business Services
2
Manufacturing
2
Transportation
1
Transportation/Logistics
1
Agriculture and Food Production
1
Food & Agriculture
1
Technology dossier →Business Services dossier →Manufacturing dossier →Transportation dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://wtyafjyizleuw4yhepmdsrcfjwmtiysunos6ixchw3r5d7eeimw2rrid.onion
  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Mallox posts a victim.

Add Mallox to your watchlist — Pro pings you within 5 minutes of any new Mallox leak-site post, Telegram callout, or affiliate-rebrand inference.