Mallox operates as a RaaS platform with affiliates conducting attacks since 2021, sharing profits with operators. The post details incident response that helped a victim fully recover and outlines Mallox’s techniques from initial access to extortion, plus recovery and lessons learned.
#Mallox #RaaS
#Mallox #RaaS
Keypoints
- Mallox is described as a Ransomware-as-a-Service (RaaS) program active since 2021, with affiliates performing attacks.
- Initial access commonly occurred via exposed MSSQL servers on internet-facing web servers, with dropper PowerShell scripts (e.g., alta.ps1).
- Persistence and backdoor access were achieved using legitimate remote software (AnyDesk).
- Mimikatz was used to dump credentials to obtain domain administrator privileges.
- Network discovery and movement involved netscan.exe for mapping and a SystemUI account created for lateral movement (system.bat).
- Ransomware activity encrypted files with the .mallab extension, performed anti-recovery checks, and used FileZilla for data exfiltration; extortion occurs via a darkweb blog.
- Recovery involved rebuilding or cleaning backups, with emphasis on identifying attacker activity to prevent re-entry; lessons stress patching, monitoring, and AD tiering.
MITRE Techniques
- [T1133] External Remote Services – The Mallox actor exploited an exposed MSSQL server for initial access.
…translated quote in English… “The Mallox threat actor is known for exploiting unsecured MSSQL servers for initial access. In this incident, the first traces of the threat actor were seen on an exposed web server running MSSQL.” - [T1059.001] PowerShell – Dropper PowerShell scripts observed (alta.ps1).
…translated quote in English… “for instance, one script called ‘alta.ps1’.” - [T1003] Credential Dumping – Mimikatz used to dump credentials and obtain domain admin privileges.
…translated quote in English… “The threat actor used Mimikatz to dump the credentials on the server they gained their initial access on. These credentials yielded the information that enabled them to access the environment as domain administrator.” - [T1046] Network Service Scanning – netscan.exe used to map the victim network (renamed netscanold.exe).
…translated quote in English… “the threat actor used an application called netscan.exe. The application is a legitimate tool developed by SoftPerfect. In the attack, the threat actor used version 6.2.1.0 and the file was renamed to netscanold.exe.” - [T1136] Create Account – SystemUI created for lateral movement via system.bat.
…translated quote in English… “The threat actor created an account called SystemUI, which was primarily used for lateral movement. The account was created with a script called system.bat.” - [T1486] Data Encrypted for Impact – Files encrypted with .mallab extension.
…translated quote in English… “The encrypted files have the extension .mallab.” - [T1041] Exfiltration – Data exfiltrated using FileZilla.
…translated quote in English… “The threat actor exfiltrates data using the legitimate software FileZilla.”
Indicators of Compromise
- [File] system.bat – SHA256=0e05b8d0a88660c00510abde3aade43291e774880ed001e3a88dbb753dcb6f52
- [File] netscanold.exe – SHA256=572d88c419c6ae75aeb784ceab327d040cb589903d6285bbffa77338111af14b
- [File] addt.ps1 – SHA256=dc404d498cc6443db5c872e6acfa394641c83313263fe2373535d7eeb49a62e9
- [IPv4] 91.215.85.142, 80.66.75.66, 80.66.75.37, 198.27.110.201, 34.197.32.16, 203.154.255.114, 103.39.109.50, 195.3.146.183
Read more: https://www.truesec.com/hub/blog/a-victim-of-mallox-ransomware-how-truesec-csirt-fought-back