Mallox Ransomware Strikes Madata Data Collection & Internet Portals
Madata Data Collection & Internet Portals Targeted by Mallox Ransomware Attack
Overview of the Attack
On June 4, 2024, the Mallox ransomware group executed a cyberattack on Madata Data Collection & Internet Portals, a company based in Mexico. The attack occurred around 11:00 PM UTC+3, compromising the organization's data infrastructure and potentially exposing sensitive information.
About Madata Data Collection & Internet Portals
Madata Data Collection & Internet Portals operates in the Media & Internet sector, providing a platform for users to access a variety of news articles and information. The company aggregates news from multiple sources, offering a comprehensive view of current events, trends, and stories from around the world. Madata.com is known for its user-friendly interface and emphasis on credible, reliable news.
Company Vulnerabilities
Given Madata's reliance on data collection and internet portal services, it becomes a prime target for ransomware attacks. The company's extensive data infrastructure and the need to maintain continuous service availability present vulnerabilities that threat actors like Mallox can exploit. The attack highlights the importance of robust cybersecurity measures in protecting sensitive information and maintaining operational integrity.
About the Mallox Ransomware Group
The Mallox ransomware group, also known as TargetCompany, FARGO, and Tohnichi, has been active since June 2021. The group targets Microsoft Windows systems, particularly exploiting unsecured MS-SQL servers. Mallox follows the double extortion trend by stealing data before encrypting files and threatening to publish the stolen data if ransom demands are not met. The group has intensified its activities recently, with a notable 174% increase in incidents.
Attack Methodology
In their attacks, Mallox ransomware operators use brute forcing, data exfiltration, and tools like network scanners. They maintain a Tor-based leaks site to communicate with victims and negotiate ransom payments. The ransomware encrypts files with a .mallox extension and leaves a ransom note with instructions on how to obtain a decryption tool using TOR. Victims who refuse to pay the ransom are threatened with data exposure on the group's leak site.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!