malas
Ransomware group profile
Description
Malas is a prominent ransomware group that targets large enterprises and critical infrastructure. Known for sophisticated attacks involving advanced encryption and double extortion tactics, they threaten to release stolen data alongside encrypting it. The group exploits vulnerabilities in widely used software to gain initial access and execute their operations.
Key insights
- •Utilizes double extortion techniques, where both data encryption and threats to leak sensitive information are employed.
- •Targets critical infrastructure sectors, particularly healthcare and finance.
- •Exploits vulnerabilities in enterprise software, including CVE-2022-24521 and CVE-2021-44228.
- •Gains initial access through social engineering and custom malware strains.
- •Increased focus on cloud services and remote work infrastructures.
- •Indicators of attack include sudden spikes in network traffic and unauthorized access to sensitive data.
Threat Level & Status Breakdown
For malas · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for malas in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for malas
T1486
T1486
T1490
T1490
T1059
T1059
T1021
T1021
T1562
T1562
T1078
T1078
T1547
T1547
T1021.001
T1021.001
T1105
T1105
T1041
T1041
T1203
T1203
T1027
T1027
Victims(27)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| ÐÐ ÐогиÑÑик | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐÑдвин-Ðева | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐзимÑÑ ÐТ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐÑаÑнÑй ÐоÑÑок ÐгÑо | — | — | Manufacturing | Claimed | about 1 month ago | |
| СÐÐÐÐ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐÑÑÑа | — | — | Manufacturing | Claimed | about 1 month ago | |
| УнивеÑÑалÑеÑÑÑÑ | — | — | Manufacturing | Claimed | about 1 month ago | |
| Ðмеди | — | — | Manufacturing | Claimed | about 1 month ago | |
| ФоÑÐ¼ÐµÐºÑ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ФÐУР“ЦÐÐÐХД | — | — | Manufacturing | Claimed | about 1 month ago | |
| Ðм ÐÑоÑÐ¸Ð»Ñ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ЯмалÑелеком | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐÑковпаÑÑажиÑавÑоÑÑÐ°Ð½Ñ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐоÑод ÐаÑе | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐебелÑÑнаб | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐÐ¸Ñ ÐеÑÑеÑеÑÐ²Ð¸Ñ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ÐевÑкий ÐлÑÑÐ½Ñ | — | — | Manufacturing | Claimed | about 1 month ago | |
| СРÐлагоÐаÑÑ | — | — | Manufacturing | Claimed | about 1 month ago | |
| еÐÑÐµÐ´Ð¸Ñ | — | — | Manufacturing | Claimed | about 1 month ago | |
| ТÑанÑÐом-Ðвиа | — | — | Manufacturing | Claimed | about 1 month ago |
Page 1 of 2
Affected countries(14)
Countries where this group has been reported to target or leak victims.