Researchers have published a new report on the “Mallox” ransomware, which has had a 174% increase in activity compared to the second half of 2022. Mallox (otherwise known as “TargetCompany” and “FARGO”) has been active since June 2021 and typically targets Microsoft Windows systems by exploiting unsecured Microsoft SQL servers. Mallox has historically targeted organizations in various industries around the globe, with a majority involved in “manufacturing, professional and legal services, and wholesale and retail.” Researchers detailed that the ransomware has been utilizing dictionary brute force attacks (using a list of common passwords against their target), data exfiltration, and network scanners in their recent campaign. Mallox uses double extortion techniques, which consist of exfiltrating data prior to encrypting files on the victim machine and threatening to publish the data on their leak site if the demanded ransom is not paid. Various members of the Mallox operation have been observed recruiting on popular hacking forums to expand their Mallox ransomware-as-a-service (RaaS) affiliate program, specifically in May 2022 and January 2023. As the Mallox operation continues to grow and gain activity, administrators are urged to ensure all internet-facing applications are secured and up-to-date. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.