Mallox Ransomware Implements New Infection Strategy

This report analyzes a Mallox (also spelled Mallox/Malox) ransomware campaign that uses BatLoader delivered via spam attachments to execute a fileless payload: an obfuscated batch/PowerShell chain that reconstructs and loads a ransomware assembly in-memory and injects it into MSBuild.exe, encrypting files with a ".malox" extension. The report describes the technical infection chain, persistence and destructive actions (mass task/service termination and deletions), geographic and industry victim distribution, MITRE ATT&CK mappings, and provides hashes, malicious URLs, and defensive recommendations.