Description
Mallox (a.k.a. FARGO) is a ransomware family active since 2021 that targets Windows servers, often reaching them through exposed Microsoft SQL Server and other database services with weak credentials. Its operators run a ransomware as a service model, and researchers have tracked its affiliates scanning for internet facing database systems to deploy the encryptor.
Stats
- First seen
- December 2023
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| ByteCode-MSIL.Ransomware.Mallox |
| ByteCode-MSIL.Trojan.Mallox |
| Gen:Variant.Ransom.Mallox.1 |
| Gen:Variant.Ransom.Mallox.12 |
| Gen:Variant.Ransom.Mallox.16 |
| Gen:Variant.Ransom.Mallox.19 |
| Gen:Variant.Ransom.Mallox.37 |
| Gen:Variant.Ransom.Mallox.9 |
| Linux.Ransomware.Mallox |
| Trojan.Ransom.Mallox.B |