MALLOX RANSOMWARE: LINUX VARIANT DECRYPTOR FOUND

Summary from the TLDR InfoSec newsletter

Mallox ransomware, which has been active since 2021, has evolved to target Linux systems using custom Python scripts for payload delivery and data exfiltration. The new variant employs AES-256 CBC encryption, appends .lmallox to encrypted files, and utilizes a Flask-based web panel for creating customized ransomware builds. Researchers have discovered decryptors for several build IDs and provided methods for detecting and hunting Mallox infrastructure using security tools like Uptycs XDR and search engines such as FOFA and Censys.