FARGO ransomware targets vulnerable Microsoft SQL servers in new wave of attacks

Microsoft SQL servers are succumbing to FARGO ransomware, security researchers at AhnLab Security Emergency Response Center (ASEC) have warned.

Alongside GlobeImposter, FARGO has become one of the most widespread ransomware that targets vulnerable MS-SQL servers, the company stated in a blog post. Statistical data from “ID Ransomware” attests to the burgeoning growth.

The strain was previously codenamed “Mallox” after analysts discerned the ransomware added a “.mallox” extension to encrypted files. Avast detailed the same strain in a report in February, labelling the ransomware “TargetCompany”.

Additionally, the cyber security firm released a decryption utility to help TargetCompany ransomware victims recover their files for free. However, the decryptor could only restore encrypted files under limited circumstances.

Decoding active exploits by FARGO ransomware, ASEC stated the strain causes a compromised machine to download a .NET file using cmd.exe and powershell.exe.

“The loaded malware generates and executes a BAT file which shuts down certain processes and services, in the %temp% directory,” added the company.

After injecting itself into AppLaunch.exe, the ransomware payload attempts to delete the registry key for the open-source ransomware vaccine Raccine. But that’s not all. The malware deactivates database processes and executes a recovery deactivation command to unencrypt confidential data.

“Administrators of MS-SQL servers should use passwords that are difficult to guess for their accounts and change them periodically to protect the database server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks,” advised ASEC.