Loading story…
Mallox ransomware operators have been linked to intrusions that begin with exposed Microsoft SQL Server instances and escalate into full-domain compromise, data theft, and file encryption. Incident responders reported that attackers established persistence with AnyDesk, harvested credentials with Mimikatz, scanned internal networks using a renamed SoftPerfect Network Scanner, and moved laterally with a newly created account named SystemUI. The group also exfiltrated data with FileZilla before deploying ransomware payloads such as ozon.exe and net_[CUSTOMER_ID].exe.
The ransomware disabled recovery mechanisms, skipped encryption on systems configured for Russia and nearby regions, and appended the .mallab extension to encrypted files. Truesec said the affected environment was recovered through server rebuilds and restoration from cleaned backups, while broader reporting from Unit 42 identified Mallox as a ransomware operation with a consistent tradecraft pattern centered on vulnerable internet-facing MSSQL services. Defenders were urged to patch and restrict exposed SQL servers, reduce externally reachable services, and harden Active Directory to limit credential abuse and lateral movement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Truesec published a case study detailing the attack chain, recovery lessons, and indicators of compromise including system.bat, netscanold.exe, addt.ps1, and multiple IP addresses.
The Truesec report states that the Mallox ransomware-as-a-service operation has been active since the middle of 2021.
According to Truesec, the affected organization recovered by rebuilding servers or restoring cleaned backups after extensive cleaning and threat hunting.
The attackers deployed ransomware samples including ozon.exe and net_[CUSTOMER_ID].exe, disabled recovery mechanisms, checked for Russia or nearby regions, contacted command-and-control infrastructure, and encrypted files with the .mallab extension while using double extortion.
After obtaining credentials, the attackers accessed the environment as domain administrator, enumerated the network with a renamed SoftPerfect NetScan utility, created the SystemUI account, and exfiltrated data with FileZilla.
In the incident described by Truesec, attackers gained initial access through an exposed web server running Microsoft SQL Server, then established persistence with AnyDesk and stole credentials with Mimikatz.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
Researchers detailed an active **Weaxor** ransomware campaign targeting enterprise **Microsoft SQL Server** environments, particularly internet-exposed or misconfigured servers with weak administrator credentials. The operation is described as the late-2024 rebrand and successor to the **Mallox/TargetCompany** ransomware family and is reportedly run as a **ransomware-as-a-service** platform. In the observed intrusion chain, attackers abused SQL Server features including `xp_cmdshell` and **OLE Automation Procedures** to trigger a heavily obfuscated PowerShell loader, which decrypted and downloaded a second-stage payload identified as `update.exe`. The second stage deployed a **Cobalt Strike Beacon** in memory, using techniques such as dynamic API resolution, PEB traversal, `ROR13` API hashing, and **WinINet** communications to retrieve additional payloads from remote infrastructure, including `154.201.236.197`, while reducing static detection. The final payload injected into the legitimate signed SQL administration utility `SQLPS.exe`, launched ransomware from a randomized path under `C:\Windows\System32`, encrypted files with a custom **ChaCha20** implementation, appended the `.weax` extension, and cleared Windows event logs through `wevtapi.dll`, hindering forensic reconstruction and attribution.
Aug 15, 2026
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026