Mallox is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 49 public victims claimed by this operator between November 4, 2022 and July 15, 2024. **Overview:** Mallox is a financially motivated ransomware group that emerged in November 2022, operating as a relatively new player in the ransomware ecosystem with a focus on extracting monetary payments from victim organizations across multiple industry sectors.
**Origin & Affiliation:** The group's country of origin and specific affiliations remain largely undocumented by major threat intelligence organizations, though their operational patterns suggest they operate independently rather than as part of a larger ransomware-as-a-service operation.
**Attack Methodology:** Limited public documentation exists regarding Mallox's specific attack vectors and technical capabilities, though their successful compromise of 49 documented victims suggests they employ conventional ransomware deployment methods including data encryption and likely extortion tactics to pressure victims into payment.
**Notable Campaigns:** Mallox has demonstrated a preference for targeting technology companies, business services, and manufacturing sectors, with their operations showing particular concentration in the United Kingdom, India, and the United States, though specific high-profile incidents have not been widely publicized by major cybersecurity firms or law enforcement agencies.
**Current Status:** The group remains active as of recent threat intelligence reporting, continuing to conduct ransomware operations across their preferred geographic and sectoral targets.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.