Loading story…
Researchers detailed an active Weaxor ransomware campaign targeting enterprise Microsoft SQL Server environments, particularly internet-exposed or misconfigured servers with weak administrator credentials. The operation is described as the late-2024 rebrand and successor to the Mallox/TargetCompany ransomware family and is reportedly run as a ransomware-as-a-service platform. In the observed intrusion chain, attackers abused SQL Server features including xp_cmdshell and OLE Automation Procedures to trigger a heavily obfuscated PowerShell loader, which decrypted and downloaded a second-stage payload identified as update.exe.
The second stage deployed a Cobalt Strike Beacon in memory, using techniques such as dynamic API resolution, PEB traversal, ROR13 API hashing, and WinINet communications to retrieve additional payloads from remote infrastructure, including 154.201.236.197, while reducing static detection. The final payload injected into the legitimate signed SQL administration utility SQLPS.exe, launched ransomware from a randomized path under C:\Windows\System32, encrypted files with a custom ChaCha20 implementation, appended the .weax extension, and cleared Windows event logs through wevtapi.dll, hindering forensic reconstruction and attribution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2024-04-15, Sekoia observed an attacker brute-force the sa account on an exposed MS-SQL honeypot and later attempt to deploy Mallox ransomware. The intrusion used recurring MS-SQL exploitation patterns and dropped PureCrypter, which decrypted and reflectively loaded a DLL that ultimately executed Mallox.
By late 2024, the operators renamed their payload from Mallox to Weaxor while continuing to target enterprise Microsoft SQL Server environments. The rebrand is described as an evolution of the same operation.
The threat group later associated with Mallox and Weaxor first appeared in mid-2021 under labels such as TargetCompany. The references describe this as the start of the operation's activity.
K7 Computing Labs published a reverse-engineering and forensic analysis of an active Weaxor ransomware campaign. The report detailed SQL Server abuse, PowerShell staging, Cobalt Strike Beacon use, and final ransomware execution via SQLPS.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyberveille.ch
Open sourceblog.sekoia.io
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mallox ransomware operators have been linked to intrusions that begin with exposed Microsoft SQL Server instances and escalate into full-domain compromise, data theft, and file encryption. Incident responders reported that attackers established persistence with **AnyDesk**, harvested credentials with **Mimikatz**, scanned internal networks using a renamed **SoftPerfect Network Scanner**, and moved laterally with a newly created account named `SystemUI`. The group also exfiltrated data with **FileZilla** before deploying ransomware payloads such as `ozon.exe` and `net_[CUSTOMER_ID].exe`. The ransomware disabled recovery mechanisms, skipped encryption on systems configured for Russia and nearby regions, and appended the `.mallab` extension to encrypted files. Truesec said the affected environment was recovered through server rebuilds and restoration from cleaned backups, while broader reporting from Unit 42 identified Mallox as a ransomware operation with a consistent tradecraft pattern centered on vulnerable internet-facing MSSQL services. Defenders were urged to patch and restrict exposed SQL servers, reduce externally reachable services, and harden Active Directory to limit credential abuse and lateral movement.
Aug 15, 2026
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026