National Emergency Center Warns of Weaxor Ransomware: How to Rescue Databases and ERP Systems When Files Become .weax/.rox/.wxx?

Recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control Technology jointly issued a security warning: multiple consecutive attacks targeting enterprise users by Weaxor ransomware have occurred in China. Many operations personnel or financial supervisors in manufacturing and trading companies suddenly found that when they opened their systems in the morning, ERP systems such as UFIDA and Kingdee could not connect to the database, the OA office system was paralyzed, and the .mdf database files, .bak backup packages, as well as various engineering drawings and financial spreadsheets on the servers, were all tampered with and appended with unfamiliar extensions such as .weax, .rox, or .wxx.

Facing the RECOVERY INFORMATION.txt or RECOVERY INFO.txt English ransom notes popping up on the desktop, enterprises often find themselves in a dilemma: core account sets and business data are locked down, and production lines and finance are completely halted; while the attackers demand high cryptocurrency ransoms, not only are funds at risk of being wasted and compliance risks involved, but there is also no guarantee that the data can be fully recovered. Before hastily reinstalling systems or blindly attempting repairs, it is essential to understand Weaxor's attack methods to secure the golden window for data rescue.

I. Why has Weaxor ransomware frequently breached enterprise defenses recently?

From a technical tracing perspective, Weaxor is not a completely new group that appeared out of nowhere; the security community generally regards it as a derivative or rebranded branch of the notorious Mallox ransomware family (also known as TargetCompany). While inheriting the high-intensity encryption logic of its predecessor, it has three characteristics in propagation and countermeasures that give enterprises severe headaches:

1. Focusing on the externally exposed surfaces of databases, OA, and ERP systems
   Weaxor does not have worm-like blind global propagation capabilities but relies heavily on precise delivery by attackers. Attackers typically scan exposed SQL Server databases (such as port 1433) on the public internet for weak password brute-force attacks, or exploit high-risk vulnerabilities in OA, ERP, and Web components to directly breach defenses. Once permissions are obtained, attackers can even, in a very short time, use multi-stage loaders to shut down security software, clear system logs, and release encryption payloads.
2. Covering both Windows and Linux platforms, virtualization and storage are not spared
   According to the official warning, Weaxor has multiple compiled versions, and attackers will deliver Windows or Linux encryption programs based on the target operating system type they have scouted. This means not only conventional Windows financial servers are affected, but also business backends, middleware, and even some storage nodes running in Linux environments are under threat.
3. Built-in credential theft capability, a single machine compromise can easily evolve into intranet takeover
   Weaxor samples infecting Windows platforms often collect and steal local system credentials and domain login credentials in addition to encrypting files. If the enterprise intranet does not have strict permission isolation, attackers can move laterally using the stolen administrator accounts, turning the compromise of an edge server into a full lockdown of the entire intranet or even the domain control environment.

II. Seeing .weax / .rox / .wxx extensions, how to stop the damage in the first 30 minutes?

When it is confirmed that abnormal extensions appear on servers or office computers, the first principle of on-site handling is "freeze the scene, block the spread". Incorrect self-rescue operations often cause more damage to data than the virus itself. It is recommended to immediately follow these steps (for a more detailed decision-making process, please refer to "What to Do After a Ransomware Attack: A Complete Emergency Decision Checklist from the First 30 Minutes of Damage Control to Business Resumption"):

• Physically disconnect from the network rather than directly unplugging the power: Immediately unplug the network cable of the infected machine, or block lateral communication of the infected network segment on the core switch or firewall (especially closing ports such as SMB 445, RDP 3389, and SQL 1433). Try to keep the compromised server powered on or only suspend it, because forcibly powering off and restarting may trigger unfinished encryption queues and also erase residual intrusion traces and key clues in memory.
• Do not delete ransom notes and suspicious temporary files: Different batches of Weaxor ransomware use different extensions such as .rox, .weax, .wxx, and the ransom note file names also vary among RECOVERY INFO.txt, RECOVERY INFORMATION.txt, FileRecovery.txt. These files, along with the byte characteristics at the beginning and end of encrypted files, are the core basis for security personnel to determine the specific variant generation.
• Strictly prohibit forced repair or attaching databases on the original disk: Many operations personnel, upon discovering SQL Server errors, first react by restarting the database service, using built-in tools to forcibly repair .mdf files, or directly mounting the backup disk to the infected host to attempt restoration. Before the cause of infection is identified and a sector-level image backup of the original disk is made, any write operation will overwrite the underlying unencrypted data fragments, completely destroying the possibility of data recovery. For common misconceptions about on-site protection, be sure to read "Don't Make These Five Mistakes After a Server Ransomware Attack: Only with a Well-Protected Scene Can Databases and Virtual Machines Be Saved".

III. Without paying ransom, how to scientifically rescue data locked by Weaxor?

Weaxor uses a multi-layered nested encryption mechanism (combining elliptic curve algorithms and symmetric encryption algorithms). Without the corresponding private key or a specific version flaw, blindly using generic decryption tools from the internet will not only fail to decrypt but also easily cause secondary damage to files.

In "Shemowule" emergency response practices, we adhere to the principle of not paying ransom and not negotiating with attackers on behalf of clients, but instead rescue core businesses through a scientific process of "first identifying the family and variant, then assessing the recoverable scope, and finally customizing the recovery path":

Step 1: Accurately identify the variant version and encryption depth

Simply looking at whether the extension is .weax or .rox is not enough to determine the nature, because some counterfeit families also use similar extensions. You can first use the free online ransomware identification tool (or refer to the ransomware extension lookup table) to upload the ransom note or enter characteristics for preliminary screening. Subsequently, engineers will conduct in-depth detection of the file structure and encryption ratio (whether the entire file is encrypted or only the header/interval data blocks) of the damaged samples, and assess whether the technical conditions for ransomware decryption are met.

Step 2: File-level reconstruction for databases, ERP, and virtualization

For variants where direct algorithmic decryption is not feasible, the focus of rescue shifts to underlying data recovery. This is why enterprise applications have more rescue potential than ordinary office documents:

• SQL Server and mainstream ERP account set repair: To pursue encryption speed for large files, Weaxor sometimes adopts partial encryption strategies, or leaves a large amount of historical transaction logs and page fragments at the disk level. For scenarios such as SQL Server encrypted and ERP systems encrypted (UFIDA, Kingdee, Guanjiapo, etc.), engineers can bypass the damaged file header and directly extract table data, stored procedures, and key account set records from the underlying page structure (Page), then reconstruct a usable database in a clean environment (for details, please refer to "How to Recover SQL Server Database Encrypted by Ransomware: Don't Force Attach MDF First, Evaluate Rescue Space in Three Steps").
• Extraction from damaged backups and virtualized images: Many times attackers encrypt local .bak backup packages or virtualized disks (such as VMDK, VHDX) together and delete volume shadow copies. When encountering backups deleted or corrupted, or ESXi / Hyper-V virtual machines encrypted, we can scan the underlying storage blocks through read-only images, strip contaminated sectors, extract undamaged database slices and historical backup remnants, and deliver them with completeness annotated by system and time point.

IV. Data recovery is only the first step: without removing resident backdoors, re-encryption is imminent

When handling Weaxor incidents, the most frustrating thing for enterprises is undoubtedly " spending several days finally restoring the ERP account set online, only to find it turned into .weax extension the next morning".

As pointed out earlier in conjunction with the National Emergency Center warning, the Weaxor attack chain is commonly accompanied by system and domain credential theft, and before releasing the ransomware, attackers often have already lurked in the intranet for hours or even days, implanting backdoors such as Cobalt Strike, obfuscated PowerShell scripts, or legitimate remote control tools like AnyDesk. If you only recover data without eradicating the attack entry point and latent backdoors, hackers can re-enter at any time with the stolen high-privilege accounts (see "Why Ransomware Data Recovery Is Followed by Re-encryption: Rescuing Data Is Only the First Step, Don't Rush to Go Online Without Cleaning These Four Types of Backdoors").

Therefore, a complete business recovery must include closed-loop security emergency response and hardening actions:

1. Attack tracing and backdoor eradication: While restoring business, analyze system logs, web access records, and memory images through attack tracing and forensics to find out whether the attacker brute-forced port 1433, exploited historical vulnerabilities in OA/ERP, or entered through third-party outsourcing maintenance channels; thoroughly clean scheduled tasks, malicious services, WMI persistence, and abnormal hidden accounts.
2. Network-wide credential reset and boundary hardening: Given Weaxor's credential theft characteristics, before going back online, all server local administrator passwords, database sa passwords, and domain control account passwords must be forcibly reset. Through security hardening protection services, shrink the external exposure surface (strictly prohibit database ports and remote desktop from being directly open to the public internet), patch high-risk application vulnerabilities, and establish off-site tamper-proof backups physically or logically isolated from the production network.

Encountered Weaxor ransomware? Get a free assessment first, then decide on a recovery plan

When core enterprise servers, databases, or ERP account sets are locked by extensions such as .weax, .rox, .wxx, time and scene integrity are lifelines. Please stay calm, do not blindly format and reinstall, or trust unofficial ransom payment channels.

"Shemowule" provides a standardized and transparent service process and pricing: Alert reception and isolation guidance → Sample analysis and family identification → Recovery feasibility assessment report and quotation → Data recovery and business verification → Tracing and forensics and security hardening. We will clearly inform you of the recoverable scope and expected results, and you decide whether to proceed.

If you are in a ransomware emergency and need immediate damage control or assessment of database recovery space, you can submit sample information through the Contact Us page at any time, or directly call the 7×24 emergency response hotline 15639272850 (emergency email: help@noransom.net) for professional technical support.