Kryptina RaaS And The Mallox Ransomware Connection

Kryptina initially a free tool on public forums has evolved into a key component in enterprise attacks particularly by the Mallox ransomware group. In May 2024 a Mallox affiliate leaked data revealing that their Linux ransomware was built on a modified version of Kryptina with only superficial changes to the source code and branding. This case highlights the commoditization of ransomware tools making malware tracking more difficult as affiliates mix different codebases to create new variants.