Outbreak Alert: Mallox Ransomware

[bmali]

Alert Email	CVE ID	Action

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
Adversary Name	Mallox Ransomware
Exploited Vulnerabilities	CVE-2024-21338:Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability CVE-2020-0618:Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability CVE-2019-1068:A remote code execution vulnerability exists in Microsoft SQL Server...
ACI Reporting Coverage	3 (Darknet), 12 (Technical Intelligence), 1 (OSINT)
Addition Reference	Total 46 victims to date. Top country victims from the United States The top victim sector falls within the Manufacturing

CVE ID	CVE-2024-21338
CVE Title	Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (mallox ransomware operators)
Exploited by APT Group(s)	Yes (lazarus group)
Included in CISA KEV List	Yes
Available working exploit(s)	2
Available POC exploit(s)	6
Darknet Mention(s)	4 (ramp, spyhackerz)
Telegram Mention(s)	4 (ARVIN, Freedom F0x, Ralf Hacker Channel, YEMEN GHOST)
FortiRecon Intelligence Reporting(s)	2 (Technical Intelligence), 2 (FortiGuard Research), 8 (OSINT), 2 (Darknet)
Vendor Advisory:	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338

CVE ID	CVE-2020-0618
CVE Title	Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (mallox ransomware operators)
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	3
Available POC exploit(s)	3
Darknet Mention(s)	1 (90sec)
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	5 (Technical Intelligence), 5 (OSINT), 2 (FortiGuard Research)
Vendor Advisory:	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618 http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserializa... http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code...

CVE ID	CVE-2019-1068
CVE Title	A remote code execution vulnerability exists in Microsoft SQL Server...
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (mallox ransomware operators)
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	2
Darknet Mention(s)	0
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	5 (Technical Intelligence), 2 (FortiGuard Research), 2 (OSINT)
Vendor Advisory:	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068