Mallox ransomware: in-depth analysis and evolution

This report provides a technical overview of the Mallox ransomware family (active since 2021), its transition into a Ransomware-as-a-Service (RaaS) model with multiple affiliates, detailed analyses of early and recent malware versions (cryptography, encryption, persistence and shutdown/anti-recovery techniques), common infection vectors (RDP/MS SQL/PostgreSQL exploitation, spam, purchased access), observed telemetry spikes, negotiation/data-leak portals used for extortion, and a list of IoCs and defensive recommendations for organizations.