TargetCompany Abusing MSSQL Servers for Ransomware (Campaign)

Researchers investigated a series of attacks by the 'TargetCompany' group exploiting poorly managed MS-SQL servers via brute-force to gain SA access, deploy Remcos RAT and remote-control tools (including AnyDesk and a custom screen-control malware), and then install Mallox ransomware which deletes shadow copies, disables recovery, terminates processes, and propagates via shared folders. The campaigns reuse C2 infrastructure seen in prior Tor2Mine and BlueSky incidents, indicating an ongoing organized criminal campaign.