A Victim of Mallox Ransomware: How Truesec CSIRT Fought Back

Mallox is a Ransomware-as-a-Service (RaaS)

Ransomware-as-a-Service (RaaS) is a cybercrime business model where operators maintain software, websites, infrastructure, and other features needed to conduct ransomware attacks. Affiliates of the RaaS program conduct the attacks and the profits are then shared between the affiliate and the operator. The Mallox ransomware has been active since the middle of 2021.

In this article I share some insights into the incident response that allowed the victim to fully recover from the ransomware attack. I …

affiliate as-a-service attacks back business csirt cybercrime features infrastructure mallox ransomware operators program raas ransomware ransomware attacks service software truesec victim websites