Loading story…
Attackers targeted externally exposed, unpatched Microsoft SQL Server systems by exploiting CVE-2019-1068 and CVE-2020-0618, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a .NET downloader, Remcos RAT, the Kill$ cleaner, and 7zip SFX-based loaders, with ransomware payloads including TargetCompany/Mallox and GlobeImposter/Alpha865qqz. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia.
In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified IOBit Unlocker as an attempted anti-security utility. Continued traffic to a fake KMSAuto-themed download site helped tie the customer incident to the wider campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In March 2022, Sophos MTR investigated a compromise of an externally exposed, unpatched Microsoft SQL Server involving TargetCompany/Mallox ransomware. Sophos CryptoGuard prevented encryption of essential files, including SQL database files, during the incident.
Sophos reported that the TargetCompany/Mallox ransomware changed its encrypted-file extension from .mallox to .avast after Avast published a decryption technique. This change was explicitly anchored to February 2022.
Sophos assessed that the same threat group was likely responsible for multiple incidents in the first half of 2022 based on shared ingress methods, infrastructure, command-and-control servers, and tooling. Most observed victims were in Asia, though Sophos also saw victims in the Americas.
Sophos investigated an uptick in attacks in early 2022 targeting externally exposed, unpatched Microsoft SQL Server instances. The attacks exploited CVE-2019-1068 and CVE-2020-0618 and delivered payloads including Remcos RAT, Kill$, TargetCompany/Mallox, and GlobeImposter/Alpha865qqz.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mallox ransomware operators have been linked to intrusions that begin with exposed Microsoft SQL Server instances and escalate into full-domain compromise, data theft, and file encryption. Incident responders reported that attackers established persistence with **AnyDesk**, harvested credentials with **Mimikatz**, scanned internal networks using a renamed **SoftPerfect Network Scanner**, and moved laterally with a newly created account named `SystemUI`. The group also exfiltrated data with **FileZilla** before deploying ransomware payloads such as `ozon.exe` and `net_[CUSTOMER_ID].exe`. The ransomware disabled recovery mechanisms, skipped encryption on systems configured for Russia and nearby regions, and appended the `.mallab` extension to encrypted files. Truesec said the affected environment was recovered through server rebuilds and restoration from cleaned backups, while broader reporting from Unit 42 identified Mallox as a ransomware operation with a consistent tradecraft pattern centered on vulnerable internet-facing MSSQL services. Defenders were urged to patch and restrict exposed SQL servers, reduce externally reachable services, and harden Active Directory to limit credential abuse and lateral movement.
Aug 15, 2026
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026
The **Kingminer** botnet has been repeatedly observed compromising publicly exposed **Microsoft SQL Server** instances by brute-forcing weak credentials on TCP port `1433`, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized **XMRig** miners, use downloader scripts and fileless **PowerShell** execution, and in some cases deliver **Cobalt Strike** beacons for persistence and post-compromise control. Investigations also found payload staging through **GitHub**, abuse of legitimate Windows binaries including `MSBuild.exe`, `rundll32.exe`, `control.exe`, and `main.cpl`, and injection into trusted processes such as `wwanmm.dll` to reduce detection. Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as **Mimikatz**. In one investigated intrusion, `sqlservr.exe` launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for **BlueKeep**-related hotfixes `KB4499175` and `KB4500331` and disabled **RDP** on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Aug 14, 2026