Loading story…
Attackers brute-forced the sa account on an internet-facing Microsoft SQL Server and escalated a compromise into a full BlueSky ransomware deployment in about 32 minutes. After access was obtained, they enabled xp_cmdshell, launched PowerShell payloads, established a Cobalt Strike beacon, and used Tor2Mine tooling to disable antivirus, create persistence, and install an XMRig-based Monero miner. The intrusion then expanded through remote service creation and SMB activity toward domain controllers and file shares before the ransomware binary, masquerading as vmware.exe, was executed on the initial host. Files were encrypted with the .bluesky extension and a ransom note named # DECRYPT FILES BLUESKY #.txt was dropped, while investigators reported no evidence of data exfiltration.
BlueSky is a Windows-focused ransomware family observed since 2022 that has been distributed through phishing emails, phishing sites, and trojanized downloads in addition to direct server compromise. Technical analysis shows the malware adjusts privileges, hides threads from debuggers, creates a mutex, and selectively skips some system-related files and directories while targeting user and database data. It accelerates encryption across local and network resources using multithreading and Windows I/O completion ports, stores recovery-related data in the Windows registry, terminates selected processes before encryption, appends the .bluesky extension to locked files, and generates ransom notes in both TXT and HTML formats.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Approximately 30 minutes after initial access in December 2022, the attackers dropped and executed the BlueSky ransomware binary named vmware.exe on the initial host. The ransomware spread over SMB, encrypted files with the .bluesky extension, and dropped the ransom note "# DECRYPT FILES BLUESKY #.txt."
During the same December 2022 intrusion, the attackers used SMB-related activity and remote service creation for lateral movement toward domain controllers and file shares. The activity matched the Cobalt Strike psexec_psh jump module.
After obtaining MSSQL access, the attackers enabled xp_cmdshell and used it to run PowerShell commands on the compromised host. They established a Cobalt Strike beacon and then executed Tor2Mine tooling that attempted defense evasion, persistence, credential access, and Monero miner deployment.
In December 2022, threat actors gained access to a victim environment by brute-forcing the "sa" account on an internet-facing Microsoft SQL Server after more than 10,000 failed login attempts.
CloudSEK reported that the BlueSky ransomware family was first observed in late June 2022. The malware targeted Windows systems and was seen distributed via phishing emails, phishing websites, and trojanized downloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **BlueSky**, an emerging Windows ransomware family that rapidly encrypts files through a multithreaded design and uses anti-analysis features plus a staged PowerShell infection chain. The malware was observed being delivered from `kmsauto[.]us` via `start.ps1` and `stage.ps1`, then saved locally as `javaw.exe`. It attempts privilege escalation with **JuicyPotato** on older Windows systems and uses exploits for `CVE-2020-0796` and `CVE-2021-1732` on newer hosts before encrypting files, appending the `.bluesky` extension, and dropping ransom notes named `# DECRYPT FILES BLUESKY #.txt` and `# DECRYPT FILES BLUESKY #.html`. Technical analysis found BlueSky shares strong code similarities with **Conti v3**, particularly in its multithreaded architecture and network share enumeration, while its cryptography aligns more closely with **Babuk** through the use of **ChaCha20** for file encryption and **Curve25519** for key generation. The ransomware excludes selected extensions and directories, creates host-specific identifiers, and stores encryption-state artifacts including a mutex and `HKCU\Software\<32-byte ID>` registry entries. Investigators also found **RedLine**-related samples hosted on the same domain, indicating possible infrastructure overlap or operational ties even though no direct code overlap was identified.
Aug 14, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Researchers detailed an active **Weaxor** ransomware campaign targeting enterprise **Microsoft SQL Server** environments, particularly internet-exposed or misconfigured servers with weak administrator credentials. The operation is described as the late-2024 rebrand and successor to the **Mallox/TargetCompany** ransomware family and is reportedly run as a **ransomware-as-a-service** platform. In the observed intrusion chain, attackers abused SQL Server features including `xp_cmdshell` and **OLE Automation Procedures** to trigger a heavily obfuscated PowerShell loader, which decrypted and downloaded a second-stage payload identified as `update.exe`. The second stage deployed a **Cobalt Strike Beacon** in memory, using techniques such as dynamic API resolution, PEB traversal, `ROR13` API hashing, and **WinINet** communications to retrieve additional payloads from remote infrastructure, including `154.201.236.197`, while reducing static detection. The final payload injected into the legitimate signed SQL administration utility `SQLPS.exe`, launched ransomware from a randomized path under `C:\Windows\System32`, encrypted files with a custom **ChaCha20** implementation, appended the `.weax` extension, and cleared Windows event logs through `wevtapi.dll`, hindering forensic reconstruction and attribution.
Aug 15, 2026