Loading story…
Avast released a free decryptor for TargetCompany ransomware, also tracked as Mallox, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take tens of hours but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including .mallox, .exploit, .architek, and .brg, and dropping the ransom note HOW TO RECOVER !!.TXT in affected folders.
Technical reporting shows the malware prepares systems for encryption by deleting shadow copies, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses ChaCha20, with key protection involving Curve25519 and AES-128, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
In February 2023, researchers detected the Xollam variant of the TargetCompany ransomware family. Unlike earlier variants that commonly exploited vulnerable Microsoft SQL Server instances, Xollam used spam campaigns with malicious Microsoft OneNote attachments and PowerShell-based reflective loading to deliver its payload.
A TargetCompany/Mallox ransomware variant targeting Microsoft SQL servers was identified. This variant appended the "Fargo" extension to encrypted files.
Avast released a free decryptor for TargetCompany ransomware victims that can recover files under certain circumstances. The tool performs a CPU-intensive password-cracking step that may take tens of hours but only needs to be completed once per affected PC and can resume from saved progress.
A ransomware victim contacted Avast for help after a TargetCompany infection. Avast identified the malware from the encrypted file extension and ransom note.
TargetCompany ransomware was first identified in June 2021 and described as active from that time. Researchers named it for appending the targeted company name as a file extension to encrypted files.
Cyble Research and Intelligence Labs reported a spike in Mallox ransomware samples in the wild, indicating increased activity and rapid spread in recent weeks. The campaign used a 32-bit .NET loader delivered via spam email to fetch, decrypt, and execute the ransomware payload in memory.
A Mallox/TargetCompany ransomware variant targeting HERRCO was observed using the .herrco extension and the ransom note "How to decrypt files.txt." The sample is documented with SHA-256 hash 415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 74 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceblog.cyble.com
Open sourcesecurityaffairs.co
Open sourcedecoded.avast.io
Open sourcebleepingcomputer.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mallox ransomware operators have been linked to intrusions that begin with exposed Microsoft SQL Server instances and escalate into full-domain compromise, data theft, and file encryption. Incident responders reported that attackers established persistence with **AnyDesk**, harvested credentials with **Mimikatz**, scanned internal networks using a renamed **SoftPerfect Network Scanner**, and moved laterally with a newly created account named `SystemUI`. The group also exfiltrated data with **FileZilla** before deploying ransomware payloads such as `ozon.exe` and `net_[CUSTOMER_ID].exe`. The ransomware disabled recovery mechanisms, skipped encryption on systems configured for Russia and nearby regions, and appended the `.mallab` extension to encrypted files. Truesec said the affected environment was recovered through server rebuilds and restoration from cleaned backups, while broader reporting from Unit 42 identified Mallox as a ransomware operation with a consistent tradecraft pattern centered on vulnerable internet-facing MSSQL services. Defenders were urged to patch and restrict exposed SQL servers, reduce externally reachable services, and harden Active Directory to limit credential abuse and lateral movement.
Aug 15, 2026
Cisco Talos released a free **ThanatosDecryptor** for victims of the Thanatos ransomware, a strain whose broken encryption routinely made files unrecoverable even after ransom payment. Researchers said Thanatos encrypted files with per-file AES-256 keys derived from a weak `GetTickCount` system-uptime value, then failed to preserve those keys, leaving victims unable to rely on the attackers for restoration. The malware renamed files with the `.THANATOS` extension, dropped a `README.txt` ransom note, created a Windows autorun registry entry to reopen the note at login, and in some cases contacted an `iplogger.com` URL to track infections. Talos said Thanatos spread in multiple campaigns, including via Discord attachments, and that some variants appeared designed to destroy data rather than support payment and decryption. The ransom note demanded about **$200** and accepted **Bitcoin, Ethereum, and Bitcoin Cash**, making it one of the first ransomware families reported to take Bitcoin Cash, yet observed wallet activity suggested the operator earned only about **$720** in total and some listed wallets were invalid or unused. Talos open-sourced its decryptor and said recovery works best on the same machine where encryption occurred, with support limited to certain file types by narrowing the 32-bit uptime-derived key space using Windows Event Log data and file timestamps.
Aug 15, 2026
Avaddon emerged as a **ransomware-as-a-service** operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and `BITSAdmin`, encrypted files with the `.avdn` extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed **RDP**, weak **VPN** credentials, and network vulnerability exploitation. As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding **DDoS** pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released **2,934 decryption keys**, which were validated by incident-response firms and used to build a free decryptor for victims.
Aug 15, 2026