Mallox Ransomware Recovery: The Ransomware That Breaks in Through MS SQL Server

Mallox, also tracked as TargetCompany, Fargo and Tohnichi, has operated since 2021 and is known for one entry point above all: Microsoft SQL Server exposed to the internet. Attackers brute-force weak sa or other SQL logins, or exploit old unpatched vulnerabilities such as CVE-2019-1068 and CVE-2020-0618, then use SQL Server itself to run commands on the server and deploy the encryptor. SentinelOne and other researchers have documented newer versions still active.

Because the attack starts at the database server, the SQL Server data files (.mdf, .ndf, .ldf) and backups (.bak) are usually among the first files encrypted. Older Mallox variants appended extensions such as .mallox, .xollam and .fargo.

Partly. Gen Digital (Avast) found a flaw in the encryption of the Mallox variant active in 2023 and early 2024 and released a free decryptor for it. The flaw was fixed around March 2024, so files encrypted by later versions cannot be decrypted this way. Try the tool on copies only, and only from the official source.

We have recovered Mallox cases ourselves. When decryption is not possible, the database can still be rebuilt from the pages the ransomware did not reach. A SQL Server data file is made of 8 KB pages, each with its own header, and large MDF files are often not encrypted end to end. We reconstruct the system tables, read the rows of each table from the intact pages and load them into a new, clean database. The same works for encrypted .bak files.

Stop the SQL Server service, copy the encrypted files to another disk, and do not run DBCC repair or attach attempts on the originals. Then contact us for a free assessment. We have solved many SQL Server ransomware cases. No data, no charge.

Never expose SQL Server port 1433 to the internet, disable or rename the sa login, use strong unique passwords for every SQL login, keep SQL Server patched, and do not run the SQL Server service as a local administrator. Keep a backup copy offline, out of reach of the database server.