What is Mallox ransomware?

Aliases and origins

Mallox is tracked under several names, TargetCompany, Fargo, and Tohnichi, reflecting different naming by researchers and different campaign labels over time. First observed around June 2021, it saw a notable surge in activity between September and December 2022, which continued into 2023, when one analysis reported an increase of roughly 174% in Mallox attacks compared with the latter half of 2022.

Described by researchers as a relatively small, closed group in its early days, Mallox has repeatedly signaled intent to grow, recruiting affiliates on hacking forums and marketplaces such as Nulled and RAMP, consistent with its RaaS model. Like many Russian-speaking-aligned operations, Mallox checks the system language on execution and avoids running in certain Commonwealth of Independent States (CIS) environments.

How Mallox attacks: tactics, techniques, and procedures

Initial access: unsecured MS-SQL servers

Mallox's defining characteristic is its focus on database servers. Operators scan for internet-exposed MS-SQL instances and launch dictionary or brute-force attacks against weak credentials, especially the powerful "sa" (SQL administrator) account. These attacks can be relentless: in one first-hand observation, an exposed server saw on the order of hundreds of brute-force attempts per minute. While MS-SQL is the hallmark, some affiliates have also used phishing emails delivering frameworks such as Cobalt Strike and Sliver as alternative entry points.

Execution and post-exploitation

After compromising the database, attackers abuse legitimate MS-SQL features to run operating-system commands, enabling capabilities like xp_cmdshell and OLE Automation and creating assemblies to execute code. They typically use the command line and PowerShell to download the Mallox payload from a remote server, sometimes wrapped in a loader such as PureCrypter to evade detection. Batch scripts terminate processes and services (databases, backups, security tools) that could interfere with encryption.

Encryption and impact

Before encrypting, Mallox disables recovery: it deletes volume shadow copies, sets the system to ignore boot failures, and stops services that would lock target files. It then encrypts files using algorithms such as ChaCha20 (and, in some variants, a combination with AES-128), appending an extension such as .mallox, .FARGO3, .xollam, or .bitenc. A ransom note is dropped in every directory with contact and payment instructions via Tor, and in many samples the malware deletes itself afterward.

Double extortion

Mallox exfiltrates data before encrypting it and maintains Tor-based leak sites where it publishes stolen data from non-paying victims. The group has also pressured affected organizations by threatening to contact their partners and, for European victims, invoking potential GDPR consequences of a data breach.

Who does Mallox target?

Mallox is broadly opportunistic: because its entry point is any exposed, weakly secured MS-SQL server, its victims are defined more by that exposure than by industry. That said, reporting has documented victims across manufacturing, professional and legal services, wholesale, retail, and other sectors, across many countries including Germany, the United States, Japan, Greece, and India. Consistent with its likely origins, it appears to avoid CIS countries.

A first-hand look: Sekoia's MS-SQL honeypot

Much of what is known about Mallox comes from vendor telemetry. Sekoia's Threat Detection & Research (TDR) team captured the attack chain directly. As part of its routine of deploying honeypots worldwide to observe real exploitation, the TDR team stood up an MS-SQL honeypot and watched a Mallox intrusion unfold in real time. The server was brute-forced on the "sa" account at a rate of around 320 attempts per minute and compromised within about an hour.

The attackers then enabled MS-SQL features such as clr and OLE Automation, created a shell assembly, and used xp_cmdshell to run commands, deploying Mallox via the PureCrypter loader (a .NET Malware-as-a-Service tool sold by a threat actor known as PureCoder). Analyzing the samples, Sekoia identified two distinct affiliates with different modus operandi: one focused on exploiting vulnerable assets, the other on broader, larger-scale compromises. The investigation surfaced affiliate handles such as Maestro, Vampire, and Hiervos, along with suspicious hosting infrastructure. Sekoia published the full technical analysis, detection opportunities, and indicators of compromise from this investigation.

How to defend against Mallox

1. Secure and patch MS-SQL servers. Avoid exposing database servers to the public internet unnecessarily, keep them patched, and place them behind proper network controls. This closes Mallox's primary door.
2. Enforce strong credentials and MFA. Use strong, unique passwords (especially for the "sa" account), disable or rename default accounts, and add multi-factor authentication (MFA) where possible to defeat brute-force attacks.
3. Monitor MS-SQL activity. Bring MS-SQL logs into the SOC and watch for repeated failed logins followed by success, connections from public IPs, and configuration changes such as enabling xp_cmdshell, clr, or OLE Automation.
4. Deploy EDR/XDR and behavioral detection. Catch post-exploitation behaviors, including PowerShell downloads, shadow-copy deletion, mass service termination, and encryption activity, rather than relying on static signatures.
5. Maintain offline, tested backups. Keep immutable or offline backups and rehearse recovery, since Mallox actively deletes shadow copies to prevent easy restoration.
6. Watch for data exfiltration. Because Mallox uses double extortion, monitor for unusual outbound transfers that may precede encryption.

Expert insight: A preventable threat that rewards the basics

The honest lesson of Mallox is this: it isn't an elite, zero-day-wielding adversary. It's a persistent, opportunistic operation that thrives almost entirely on one thing, exposed MS-SQL servers with weak passwords. Its longevity says less about the group's sophistication than about how many organizations leave database servers reachable from the internet with guessable credentials. That makes Mallox unusually preventable: close that door, and you defeat its primary campaign. Detection still needs to sit where the attack actually happens, at the database and in post-exploitation behavior, not only at the email gateway.

Because Sekoia's TDR team observed a live Mallox intrusion on its own MS-SQL honeypot, the detection guidance built into the Sekoia SOC platform targets exactly the behaviors this group exhibits: brute-force patterns against the "sa" account, suspicious MS-SQL configuration changes (xp_cmdshell, clr, OLE Automation), PowerShell payload downloads, shadow-copy deletion, and mass service termination before encryption. That first-hand research feeds native Sekoia Intelligence, so indicators tied to Mallox and its affiliates can be correlated across telemetry and retro-hunted through the platform's integrations, including MS-SQL logs not natively collected in Windows event logs but essential for catching this attack. Paired with automated incident response, a brute-forced database session can be contained before encryption begins. As a European vendor with a data-sovereignty posture, Sekoia is well suited to the regulated organizations Mallox explicitly pressures with GDPR threats.