Overview
Mallox is a ransomware operation that has been active since June 2021, tracked under multiple names — TargetCompany (the earliest attribution label), FARGO, and Xollam are the same underlying group at different points in their operational history or as seen by different researchers. Palo Alto Unit 42 documented the group’s evolution in detail, establishing the lineage.
What distinguishes Mallox from the broader ransomware ecosystem is its persistent focus on MS-SQL server exploitation as a primary initial access vector. While most ransomware affiliates rely on phishing or purchased initial access broker credentials, Mallox specifically targets internet-exposed Microsoft SQL Server instances, exploiting unpatched vulnerabilities or brute-forcing weak credentials. This makes Mallox’s victim profile different from groups that cast a wider net: organisations with internet-exposed database servers, often in manufacturing, professional services, and mid-market technology.
In 2023, Mallox announced a shift toward a ransomware-as-a-service model and released a Linux encryptor — built on the leaked Kryptina source code — extending the operation to VMware ESXi hypervisors and Linux servers. The Linux variant significantly expands the potential target pool to include virtualised infrastructure.
Initial Access: MS-SQL Exploitation
Mallox’s signature approach is scanning for internet-accessible MS-SQL servers (port 1433) and exploiting them through two primary methods:
Brute force against weak credentials. MS-SQL servers are frequently deployed with the sa (system administrator) account enabled and protected by weak or default passwords. Mallox operators systematically attempt credential lists against discovered instances. Once authenticated, the xp_cmdshell stored procedure — which allows SQL Server to execute operating system commands — provides a direct path to code execution if enabled.
Vulnerability exploitation. Mallox has exploited specific MS-SQL vulnerabilities in documented campaigns. The group leveraged CVE-2020-0618 (SQL Server Reporting Services remote code execution) in earlier campaigns and has targeted unpatched SQL Server versions broadly.
The choice of MS-SQL exploitation over phishing is operationally significant: it produces reliable, unattended initial access without requiring social engineering, and MS-SQL servers are widely found in enterprise environments without the network monitoring attention given to edge devices like VPNs.
Post-Compromise TTPs
Once inside via MS-SQL, Mallox follows a consistent post-exploitation playbook:
Execution via xp_cmdshell: The attackers enable the SQL Server’s xp_cmdshell procedure if not already active (using T-SQL commands via their authenticated connection) and use it to execute PowerShell or cmd commands directly from the SQL process context.
Payload delivery via PowerShell: Mallox payloads are typically delivered through PowerShell one-liners that download the encryptor from attacker-controlled infrastructure. The PowerShell execution runs with the privileges of the SQL Server service account — which in misconfigured environments may run as Local System or a high-privilege domain account.
Credential harvesting: Mimikatz or similar tools are used to extract credentials from the compromised host, enabling lateral movement to adjacent systems before encryption begins.
Defence evasion: Mallox terminates security-relevant processes and disables Windows Defender via PowerShell commands before deploying the encryptor. Shadow copies are deleted using vssadmin to prevent volume snapshot recovery.
Data exfiltration: The group operates a leak site and exfiltrates data before encryption — standard double-extortion mechanics. Exfiltration typically uses the attacker’s own tools or rclone for cloud storage transfer.
The Linux/ESXi Variant
In 2023, Mallox released a Linux encryptor attributed to Kryptina — a ransomware-as-a-service builder whose source code leaked publicly in December 2023. Kryptina targets Linux and VMware ESXi systems and was adopted by multiple ransomware groups after the leak.
The Mallox-affiliated Kryptina variant operates against ESXi hypervisors in the same way as other ESXi-targeting ransomware: it encrypts virtual machine disk files (.vmdk), virtual machine swap files, and configuration files while VMs are shut down or suspended. On a hypervisor running dozens of virtual machines, a single encryptor execution can render an entire virtualised environment inoperable.
Key characteristics of the Linux/ESXi variant:
- Targets ESXi-specific extensions:
.vmdk,.vmem,.vswp,.vmx,.vmxf,.nvram - Uses ChaCha20 for file encryption with RSA-2048 key wrapping
- Drops a ransom note per encrypted directory
- Communicates with C2 via HTTPS for decryption key escrow
The availability of the Kryptina codebase to Mallox reflects a broader pattern: ransomware groups that previously built Windows-only toolsets acquiring Linux/ESXi capability either through source code reuse, partnership, or direct development — expanding their effective target universe without building from scratch.
Affiliate Model and Operations
Mallox transitioned from a closed operation to a RaaS model around mid-2023, advertising on cybercriminal forums and offering affiliates a revenue share. The affiliate recruitment focused on operators who could supply MS-SQL exploitation expertise or existing network access to MS-SQL-rich environments.
The leak site follows standard double-extortion mechanics: exfiltrated victim data is published after the ransom deadline, or earlier if the victim publicly denies the attack. Mallox’s leak site, operating since 2021 with multiple iterations, has listed victims across at least 40 countries, with concentration in Asia, Europe, and North America.
Ransom demands in documented cases range from tens of thousands to several million dollars, calibrated against victim size and data sensitivity. The MS-SQL focus tends to produce victims in the mid-market — organisations large enough to run SQL Server-based applications but with less mature perimeter monitoring than enterprises.
Victim Profile and Targeting
Mallox’s victim profile is primarily driven by the internet-exposure of MS-SQL infrastructure rather than sector-specific targeting. The result is a mix of:
- Manufacturing companies using MS-SQL-backed ERP systems (SAP, Epicor, Infor)
- Professional services firms running custom SQL-backed applications
- Healthcare organisations with MS-SQL database backends for clinical systems
- Financial services companies with trading or back-office SQL infrastructure
- Technology companies with MS-SQL in development or test environments exposed to the internet
The ESXi variant expands the attack surface to any organisation running VMware without appropriate hypervisor management network segmentation.
Detection and Hardening
Remove MS-SQL from internet exposure. Port 1433 should not be accessible from the internet in any production environment. Place SQL Server instances behind a VPN, bastion host, or network access control list that restricts connections to authorised source IPs.
Disable xp_cmdshell. The xp_cmdshell stored procedure should be disabled on all SQL Server instances unless specifically required. It is not enabled by default in modern SQL Server installations but may have been enabled during application troubleshooting:
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;Enforce strong sa credentials and disable the account where not needed. Audit all SQL Server instances for the sa account status. If it must be enabled, enforce a minimum 16-character random password. Consider renaming it, though this is a weak control on its own.
Alert on xp_cmdshell execution. Even if disabled, attempts to enable or execute xp_cmdshell should generate security alerts. SQL Server audit features and Extended Events can capture this:
CREATE SERVER AUDIT MalloxAudit TO FILE (FILEPATH = 'C:\AuditLogs\');
CREATE SERVER AUDIT SPECIFICATION MalloxSpec
FOR SERVER AUDIT MalloxAudit
ADD (EXECUTE OBJECT ACCESS GROUP)
WITH (STATE = ON);Monitor for ESXi management plane exposure. VMware ESXi management interfaces (port 443 and 902) should not be internet-accessible. Restrict ESXi host access to the management VLAN, with access only via jump server or VPN.
Shadow copy protection. Enable Microsoft’s Protected Users security group and restrict which accounts can execute vssadmin delete shadows. Mallox’s shadow deletion step using vssadmin is a detectable event in process creation logs.
Mallox is not among the highest-profile ransomware operations by victim count, but its database-centric initial access vector makes it a distinctive threat to organisations with internet-exposed MS-SQL infrastructure — a gap that remains common in environments where application teams control database deployment without security review.