Ransomware Group intelligence
Mallox
InactiveTrack Mallox with 50 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Mallox is tracked by Breach House as a ransomware group with 50 published victims.
India is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 1h ago | wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion |
Top Activity Sectors (11)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Mallox, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: mallox executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: mallox persists via registry run keys and startup folders to ensure recurring execution after reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: mallox disables antivirus tools and security software via command-line utilities to evade detection and persistence.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: mallox encodes victim data using symmetric encryption routines to render files inaccessible without decryption keys.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: mallox deletes Volume Shadow Copies and backup directories using vssadmin and file deletion commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: mallox scans network shares using SMB tools to identify victim hosts for lateral movement and data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1486 Data Encrypted for Impact Impact
What they do: mallox encrypts victim files with custom ransomware binaries, targeting documents and system data for impact.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: mallox halts system recovery by terminating critical services and disrupting backup restoration processes.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Tools Observed (3)
▼Software Mallox has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Exfiltration
Dropmefiles
File[.]io
Sendspace
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Crypto Wallets (1)
▼
$20,262
Received (USD)
1
Payments
1
Known wallets
$20,262
Largest single payment
2023-04-27 → 2023-04-27
Payment window
bitcoin · 1
| Address | Chain | Received (USD) | Payments |
|---|---|---|---|
38uTYmRfywB9F96DHFRh8g15SbfQiZudEq |
bitcoin | $20,262 | 1 |
Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
HOW TO BACK FILES.txt
Hello Your files are encrypted and can not be used We have downloaded your confidential data and are ready to publish it on our blog To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: [snip] 5) You will see payment information and we can make free test decryption here 6)After payment, you will receive a tool for decrypting files, and we will delete the data that was taken from you Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.
FILE RECOVERY.txt
Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: [snip] 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (50)
Search, filter and paginate the victim timeline for Mallox. Showing 1–50 of 50.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | integraservices id13365 View details | Services | |||
|
Description not available |
|||||
| Ransomware | XENAPP-GLOBER id13364 View details | Other | |||
|
Description not available |
|||||
| Ransomware | "Moshe Kahn Advocates" id12885 View details | Israel | Finance / Legal / Insurance | — | |
|
Description not available |
|||||
| Ransomware | Madata Data Collection & Internet Portals id12813 View details | Mexico | Other | ||
|
Description not available |
|||||
| Ransomware | Río Negro id12812 View details | Argentina | Other | ||
|
Description not available |
|||||
| Ransomware | Assist Informatica id12715 View details | Italy | Other | — | |
|
Description not available |
|||||
| Ransomware | speditionlangen.de id11559 View details | Germany | Other | — | |
|
Description not available |
|||||
| Ransomware | highfashion.com.hk id11261 View details | Hong Kong | Other | — | |
|
Description not available |
|||||
| Ransomware | Ramdev Chemical Industries id11260 View details | India | Manufacturing / Engineering | — | |
|
Description not available |
|||||
| Ransomware | Rafum Group id11259 View details | Pakistan | Services | — | |
|
Description not available |
|||||
| Ransomware | Versatile Card Technology Private Limited id9229 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | DUHOCAAU id9088 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Measuresoft id8939 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | Kirkholm Maskiningeniører id8928 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | BOZOVICH TIMBER PRODUCTS INC id8565 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Kogetsu id8003 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Contec Systems id7974 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | West Cargo id7946 View details | Transportation / Travel / Logistics | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Franklins european bathrooms id7421 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Garuda Indonesia id7194 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Ashley HomeStore id7096 View details | Retail / E-commerce | |||
|
INFO: https://www.zoominfo.com/c/ashley-homestore-ltd/7786767 DATA: https://anonfiles.com/9447C8z8z7/Ashley_7z PASSWORD: 597+9Tk?2gtW&&_6SW5#7<);D&81Q5)c |
|||||
| Ransomware | JBCC Corp id7043 View details | Japan | Services | ||
|
INFO: https://www.zoominfo.com/c/jbcc/431568723 DATA: CISDOM.7z.004: https://anonfiles.com/3eH2a3zez6/CISDOM_7z_004 CISDOM.7z.003: https://anonfiles.com/KfH1a5z6ze/CISDOM_7z_003 CISDOM.7z.002: https://anonfiles.com/MfHca7zfzd/CISDOM_7z_002 CISDOM.7z.001: https://anonfiles.com/FeH5aaz7z5/CISDOM_7z_001 Password: &q.&i_R327:3p1<dBtEK~L02HT(4C3JZ |
|||||
| Ransomware | COMPASS INFRASTRUCTURE GROUP id7034 View details | United States | Construction / Real Estate | ||
|
DATA: COMPASS.7z.001 https://anonfiles.com/34xeP5y9z4/COMPASS_7z_001COMPASS.7z.002 https://anonfiles.com/lav9P7ycz1/COMPASS_7z_002COMPASS.7z.003 https://anonfiles.com/Ebu4P0yaz2/COMPASS_7z_003 PASSWORD: he?A!xl_<90!T9O>5a3KC5;h^*$7pjpZ |
|||||
| Ransomware | Tlantic id7012 View details | Other | |||
|
INFO: https://www.zoominfo.com/c/tlantic/346591091 DATA: https://anonfiles.com/h6F8rcybz7/tlantic_7z PASSWORD: 77UXD&CNqq@c+2rX$46~Y895rQX7Th7j |
|||||
| Ransomware | MICA ENVIRONNEMENT id6963 View details | France | Manufacturing / Engineering | ||
|
DATA PARTS: Mica.7z.001 https://anonfiles.com/Qat8K6x8zf/Mica_7z_001 Mica.7z.002 https://anonfiles.com/P6t7K0xcz0/Mica_7z_002 Mica.7z.003 https://anonfiles.com/u4s2K7xaz3/Mica_7z_003 Mica.7z.004 https://anonfiles.com/R1tfK5xezc/Mica_7z_004 Mica.7z.005 https://anonfiles.com/f2t9K8xdzc/Mica_7z_005 Mica.7z.006 https://anonfiles.com/JdudK4x7z6/Mica_7z_006 Mica.7z.007 https://anonfiles.com/N9ueK6xbz4/Mica_7z_007 Mica.7z.008 https://anonfiles.com/zcw2Kcxbz8/Mica_7z_008 Mica.7z.009 https://anonfiles.com/16w5Kbx1zd/Mica_7z_009 Mica.7z.010 https://anonfiles.com/22w7K5xeze/Mica_7z_010 Mica.7z.011 https://anonfiles.com/09w8Kcxdz6/Mica_7z_011 Mica.7z.012 https://anonfiles.com/30w4Kaxcza/Mica_7z_012 Mica.7z.013 https://anonfiles.com/59z4K5x7z2/Mica_7z_013 Mica.7z.014 https://anonfiles.com/wez5K7x2z4/Mica_7z_014 Mica.7z.015: https://anonfiles.com/i7z0Kbx8z8/Mica_7z_015 PASSWORD: 9n?M)YLZ737Fr5ttZ7u$YU01j<4&5ZrW |
|||||
| Ransomware | Bangkok Industrial Gas Co., Ltd. (BIG) id6925 View details | Energy | |||
|
DATA:https://anonfiles.com/X9A7y8x5ze/GAS_rar PASSWORD: c2OG7Qx$SNSnz6o5AE2,s<WOgUNIz5&4 |
|||||
| Ransomware | Share and Harris id6721 View details | United States | Other | ||
|
INFO: https://www.zoominfo.com/c/share-harris-llc/410899856 DATA: https://anonfiles.com/D8nfa0v0zd/ShareHarris_rar PASSWORD: (Oa+VB;~5k5S1W,LW8!P#6d31v8IZ%Jk |
|||||
| Ransomware | FICCI id6717 View details | India | Communication / Marketing | ||
|
Established in 1927, FICCI is the largest and oldest apex business organisation in India. Its history is closely interwoven with India's struggle for independence, its industrialization, and its emergence as one of the most rapidly growing global economies.A non-government, not-for-profit organisation, FICCI is the voice of India's business and industry. From influencing policy to encouraging debate, engaging with policy makers and civil society, FICCI articulates the views and concerns of industry. It serves its members from the Indian private and public corporate sectors and multinational companies, drawing its strength from diverse regional chambers of commerce and industry across states, reaching out to over 2,50,000 companies.FICCI provides a platform for networking and consensus building within and across sectors and is the first port of call for Indian industry, policy makers and the international business community. FILES: https://anonfiles.com/h9F2u9Z3yc/FICCI_rar PASSWORD: BUHgv97yt9f7fcv7c-p8 |
|||||
| Ransomware | CCAA id6716 View details | Brazil | Other | ||
|
INFO: https://www.zoominfo.com/c/ccaa/372444807?__cf_chl_tk=9kqu5SXzH664NKjerVDLfEaOpLl2.oSyDBUZT_Sx2v8-1679667712-0-gaNycGzNDOU https://anonfiles.com/Fb6aCdg6zd/CCAA_rar Pass: U&YV(C&t6c97tc(&TC97tcdf(V&TC9 |
|||||
| Ransomware | Young Homes, Inc id6715 View details | United States | Services | ||
|
INFO: https://www.zoominfo.com/c/young-homes-inc/134103843 DATA: https://anonfiles.com/8d12Yfudzf/Yhomes_rar PASSWORD: Vzha#FhkRRm=-h&Xw07lmVXPUe5H,K;# |
|||||
| Ransomware | Circa Jewels id5586 View details | Communication / Marketing | |||
|
Circa Jewels is the leading international buyer of pre-owned fine jewelry, diamonds and watches. If Circa Jewels fail to take responsibility for their security weakness, all of their and their clients' confidential will be published. File Tree - https://anonfiles.com/N52cufc5z0/filetree_txt Last date - 20th March 2023 Contact ( https://tox.chat ) - AE3750EE1BE48D86104E6FB1DADC32469A31242EFC205A3EC47EF7689E3F103472A4DBFFF399 |
|||||
| Ransomware | AddWeb Solution Pvt id5581 View details | IT | |||
|
AddWeb Solution Pvt is a leading offshore development company provides a one-stop website, mobile, cloud, and digital marketing solution. If AddWeb Solution Pvt fail to take responsibility for their security weakness, all of their and their clients' confidential will be published. File Tree - https://anonfiles.com/gab0ifc8z3/filetree_txt Last date - 19th March 2023 Contact ( https://tox.chat ) - AE3750EE1BE48D86104E6FB1DADC32469A31242EFC205A3EC47EF7689E3F103472A4DBFFF399 |
|||||
| Ransomware | AICHELIN UNITHERM id5573 View details | India | — | — | |
|
Two leading manufacturers of heat treatment furnaces Unitherm Engineers Limited (India) and Aichelin Holding GmbH (Austria) formed a new 50:50 Joint Venture Company (JVC) in India in 2010. The newly incorporated JVC Aichelin Unitherm Heat Treatment Systems India Private Limited is headquartered in Talegaon, Pune (Maharashtra).Whatever part you play in the field of industrial heat treatment, AICHELIN UNITHERM has a solution for you. As diverse as the product portfolio may be, certain things apply to every solution: reliability and economic efficiency. AICHELIN UNITHERM in joint venture with AICHELIN Group offers extensive experience and skill guaranteeing the security of a stable and strong group, as your partners and service providers.Industrial heat treatment of metallic parts and components is our skill and passion. AICHELIN UNITHERM is the leading manufacturer of Industrial Heat Treatment Plants technology and services in India. DATA: https://anonfiles.com/D583Qcb3z9/AICHELIN_UNITHERM_rar PASSWORD: n246nm245&TC675tcd^R |
|||||
| Ransomware | AICHELIN UNITHERM id32042 View details | India | — | — | |
|
Two leading manufacturers of heat treatment furnaces Unitherm Engineers Limited (India) and Aichelin Holding GmbH (Austria) formed a new 50:50 Joint Venture Company (JVC) in India in 2010. The newly incorporated JVC Aichelin Unitherm Heat Treatment Systems India Private Limited is headquartered in Talegaon, Pune (Maharashtra).Whatever part you play in the field of industrial heat treatment, AICHELIN UNITHERM has a solution for you. As diverse as the product portfolio may be, certain things apply to every solution: reliability and economic efficiency. AICHELIN UNITHERM in joint venture with AICHELIN Group offers extensive experience and skill guaranteeing the security of a stable and strong group, as your partners and service providers.Industrial heat treatment of metallic parts and components is our skill and passion. AICHELIN UNITHERM is the leading manufacturer of Industrial Heat Treatment Plants technology and services in India. DATA: https://anonfiles.com/D583Qcb3z9/AICHELIN_UNITHERM_rar PASSWORD: n246nm245&TC675tcd^R |
|||||
| Ransomware | "FICCI" id5517 View details | India | Communication / Marketing | — | |
|
Established in 1927, FICCI is the largest and oldest apex business organisation in India. Its history is closely interwoven with India's struggle for independence, its industrialization, and its emergence as one of the most rapidly growing global economies.A non-government, not-for-profit organisation, FICCI is the voice of India's business and industry. From influencing policy to encouraging debate, engaging with policy makers and civil society, FICCI articulates the views and concerns of industry. It serves its members from the Indian private and public corporate sectors and multinational companies, drawing its strength from diverse regional chambers of commerce and industry across states, reaching out to over 2,50,000 companies.FICCI provides a platform for networking and consensus building within and across sectors and is the first port of call for Indian industry, policy makers and the international business community. FILES: https://anonfiles.com/h9F2u9Z3yc/FICCI_rar PASSWORD: BUHgv97yt9f7fcv7c-p8 |
|||||
| Ransomware | Mecaro Co., Ltd id5459 View details | IT | — | ||
|
Company Introduction : Mecaro Co., Ltd is No1 Best Semicon parts company authorized in parts area by producing optimal semiconductor part of equipments through ceaseless technology development and research for about 15 years. MORE INFO: https://www.wsj.com/market-data/quotes/KR/241770/financials LEAKED DATA: https://anonfiles.com/bb60w5Ydy6/PLM_zip PASSWORD FOR ARCHIVE: kPl%l!ttuJ8;1Dxali3u1TzO%gk=7tJh |
|||||
| Ransomware | Hydrofit Alliance Ltd id5458 View details | Energy | — | ||
|
Hydrofit FZE an ISO 9001, ISO 14001 & 45001 company, pioneering in the field of Fluid Power Transmissions, Mechanical Power Transmissions, Automatic Greasing / Lubrication systems and Oil Recirculation systems MORE INFO: https://www.zoominfo.com/c/hydrofit-alliance-ltd/346285910?__cf_chl_tk=5mBW2PYNvvqwAbHrTvIe_QmsK7qT8ybeY2RH3Kvmf8w-1676508140-0-gaNycGzND7s LEAKED DATA: https://anonfiles.com/Y7Q9weYcy2/hydrofitgroup_zip PASSWORD: p>7JEwOJ8i994RC=*69?J<q648H.:xE/ |
|||||
| Ransomware | Gallier Orléans id5457 View details | France | Other | — | |
|
DATA: https://anonfiles.com/NfWdw2Yby8/GALLIER_zipPASSWORD: ?ie(yD@83,%0HR^t6_#S|VW*L6^cA-B\ |
|||||
| Ransomware | Navnit Group id5290 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | BOMCALCADO id5287 View details | Portugal | Other | — | |
|
DATA PART 1: https://anonfiles.com/O7N1M7Tfy2/bomcalcado1_zip DATA PART 2: https://anonfiles.com/K7O7MaTdy7/bomcalcado2_zip PASSWORD: Q|&(A&\?Le($PxD=c,_cj*hLl@+|!,K# |
|||||
| Ransomware | First International Food co Ltd id5286 View details | Saudi Arabia | Agriculture / Food | — | |
|
DATA: https://anonfiles.com/4ew5MbT6y1/fifood_zipPASSWORD: !BJYY-U_;pvuz.dlzbd~*>W;YX;x$?fM |
|||||
| Ransomware | Alhambra-Eidos id5266 View details | Other | — | ||
|
https://www.zoominfo.com/c/alhambra--eidos/345908828?__cf_chl_tk=RpuNsHtJ3U8_aY_cJ.nM3xGgTjQUbdlu39sPdA54pLg-1674049852-0-gaNycGzNC-U Leaked data: https://anonfiles.com/********/Alhambra_rar Password: *&YG)*7vc08V()*&YguygoiugO |
|||||
| Ransomware | Yayla Enerji Uretim Turizm ve Insaat Ticaret id5254 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | El Seif Development id5249 View details | IT | — | ||
|
Data will be published in 24 hours Stay tuned |
|||||
| Ransomware | ADIVA CO. LTD id5221 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Ban Leong Technologies Ltd id4842 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Canny Elevator Co Ltd id4498 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | API MDC Technical Research Centre Sdn Bhd id4497 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Aerotech Precision Manufacturing id4496 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | CLUB DE TENIS LA PAZ id4495 View details | Other | — | ||
|
No additional victim description available. |
|||||