Mallox Ransomware Strikes Madata Data Collection & Internet Portals
Incident Date:
June 7, 2024
Overview
Title
Mallox Ransomware Strikes Madata Data Collection & Internet Portals
Victim
Madata Data Collection & Internet Portals
Attacker
Mallox
Location
First Reported
June 7, 2024
Madata Data Collection & Internet Portals Targeted by Mallox Ransomware Attack
Overview of the Attack
On June 4, 2024, the Mallox ransomware group executed a cyberattack on Madata Data Collection & Internet Portals, a company based in Mexico. The attack occurred around 11:00 PM UTC+3, compromising the organization's data infrastructure and potentially exposing sensitive information.
About Madata Data Collection & Internet Portals
Madata Data Collection & Internet Portals operates in the Media & Internet sector, providing a platform for users to access a variety of news articles and information. The company aggregates news from multiple sources, offering a comprehensive view of current events, trends, and stories from around the world. Madata.com is known for its user-friendly interface and emphasis on credible, reliable news.
Company Vulnerabilities
Given Madata's reliance on data collection and internet portal services, it becomes a prime target for ransomware attacks. The company's extensive data infrastructure and the need to maintain continuous service availability present vulnerabilities that threat actors like Mallox can exploit. The attack highlights the importance of robust cybersecurity measures in protecting sensitive information and maintaining operational integrity.
About the Mallox Ransomware Group
The Mallox ransomware group, also known as TargetCompany, FARGO, and Tohnichi, has been active since June 2021. The group targets Microsoft Windows systems, particularly exploiting unsecured MS-SQL servers. Mallox follows the double extortion trend by stealing data before encrypting files and threatening to publish the stolen data if ransom demands are not met. The group has intensified its activities recently, with a notable 174% increase in incidents.
Attack Methodology
In their attacks, Mallox ransomware operators use brute forcing, data exfiltration, and tools like network scanners. They maintain a Tor-based leaks site to communicate with victims and negotiate ransom payments. The ransomware encrypts files with a .mallox extension and leaves a ransom note with instructions on how to obtain a decryption tool using TOR. Victims who refuse to pay the ransom are threatened with data exposure on the group's leak site.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.