Reported by 1 outlet

Timeline

1. original reporting

   When SQL Server Becomes the Initial Launcher: A Deep Dive into Weaxor Ransomware Execution

   malware.news · 61d ago · August 13th, 2026

   Recent threat intelligence highlights a sophisticated Weaxor Ransomware deployment strategy utilizing high-privilege application abuse and layered in-memory evasion. While post-exploitation actions deliberately cleared critical operating system and application log telemetry to obscure the initial access vector, deep forensic reconstruction of telemetry data and process monitoring logs reveals a heavily obfuscated execution chain. The adversary relied extensively on Microsoft SQL Server exploitation, multi-layered PowerShell Deobfuscation, Cobalt Strike Beacon execution. This analysis provides an exhaustive technical breakdown of the evasion mechanics and structural execution steps discovered within the payload chain. Threat Background: The Evolution from Mallox to Weaxor First appearing in mid-2021 under labels like “TargetCompany”, the threat group behind Weaxor originally operating as the notorious Mallox ransomware family has matured from a rudimentary threat into a sophisticated ransomware-as-a-service (RaaS) operation. By late 2024, the group underwent a tactical rebranding, shifting their payload name from Mallox to Weaxor to evade security detection profiles and confuse defenders. Despite the ne