IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

FARGO ransomware targets vulnerable Microsoft SQL servers in new wave of attacks

Victims who don't pay the ransom risk having their stolen files exposed on the threat actor's Telegram channel

Microsoft SQL servers are succumbing to FARGO ransomware, security researchers at AhnLab Security Emergency Response Center (ASEC) have warned.

Alongside GlobeImposter, FARGO has become one of the most widespread ransomware that targets vulnerable MS-SQL servers, the company stated in a blog post. Statistical data from “ID Ransomware” attests to the burgeoning growth.

Related Resource

How to reduce the risk of phishing and ransomware

Top security concerns and tips for mitigation

Large letter 'O' against a background of a city - whitepaper from MimecastFree download

The strain was previously codenamed “Mallox” after analysts discerned the ransomware added a “.mallox” extension to encrypted files. Avast detailed the same strain in a report in February, labelling the ransomware “TargetCompany”.  

Additionally, the cyber security firm released a decryption utility to help TargetCompany ransomware victims recover their files for free. However, the decryptor could only restore encrypted files under limited circumstances.

Decoding active exploits by FARGO ransomware, ASEC stated the strain causes a compromised machine to download a .NET file using cmd.exe and powershell.exe.

“The loaded malware generates and executes a BAT file which shuts down certain processes and services, in the %temp% directory,” added the company.

After injecting itself into AppLaunch.exe, the ransomware payload attempts to delete the registry key for the open-source ransomware vaccine Raccine. But that’s not all. The malware deactivates database processes and executes a recovery deactivation command to unencrypt confidential data.

“Administrators of MS-SQL servers should use passwords that are difficult to guess for their accounts and change them periodically to protect the database server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks,” advised ASEC.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
cyber crime

Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation

25 Nov 2022