Ransomware group profile · #96 by claimed victims

Mallox ransomware

This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this malware is dated to mid-June 2021. The extension of the encrypted files are set to the compromised company: .<target_company>

Active First seen Nov 2022

49Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

14Countries hit

3Leak-site URLs tracked, 0 online

15 Jul 2024Latest claim recorded

Victimology

Who Mallox claims to have breached, from 49 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Technology10

Manufacturing8

Professional Services8

Agriculture and Food Production6

Retail & E-Commerce4

Transportation3

Energy & Utilities3

Other2

Top countries

India4

United States3

France2

Mexico1

Portugal1

Pakistan1

Argentina1

Saudi Arabia1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
integraservices	Professional Services	—	15 Jul 2024
XENAPP-GLOBER	Technology	—	15 Jul 2024
"Moshe Kahn Advocates" kahn.co.il	Professional Services	IL	5 Jun 2024
Madata Data Collection & Internet Portals madata.com	Technology	MX	4 Jun 2024
Río Negro	Agriculture and Food Production	AR	4 Jun 2024
Assist Informatica	Technology	IT	25 May 2024
speditionlangen.de speditionlangen.de	Transportation	DE	9 Apr 2024
highfashion.com.hk highfashion.com.hk	Professional Services	HK	17 Mar 2024
Ramdev Chemical Industries ramdevpigments.com	Manufacturing	IN	17 Mar 2024
Rafum Group rafumgroup.com	Professional Services	PK	17 Mar 2024
Versatile Card Technology Private Limited	Technology	—	26 Oct 2023
DUHOCAAU	Not Found	—	14 Oct 2023

All 49 Mallox victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Mallox is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Mallox ransomware still active?

Mallox is tracked as active. The most recent leak-site claim VULONE recorded is dated 15 July 2024.

How many victims has Mallox claimed?

VULONE has recorded 49 leak-site victim claims attributed to Mallox since November 2022, across 14 countries and 10 sectors.

Which industries does Mallox target?

The sectors most often named on the Mallox leak site are Technology, Manufacturing, Professional Services.

Which countries are most affected by Mallox?

Most Mallox victims recorded by VULONE are located in India, United States, France.

Where does VULONE get Mallox victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].