Weaxor is Windows ransomware that appeared in late 2024 as a rebrand of Mallox, also called TargetCompany. Most samples add .rox to each file, and one 2025 case used .WEAX. The note points to a Tor chat page and offers to unlock three small test files. It hits public-facing servers, mostly Microsoft SQL Server, and in one case a web app through the React2Shell flaw. Intruders run PowerShell through the SQL tool sqlps.exe, load a Cobalt Strike beacon and then drop the encryptor. Ransoms are modest. No leak site exists, though Mallox did steal data.
File extensions: .rox, .weaxor
Ransom note filenames: FILE RECOVERY.txt, HOW_TO_RECOVER_FILES.txt, README.txt, RECOVERY INFO.txt, weaxor-readme.txt
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161