Mallox encrypts SQL Server and an ERP database at a manufacturing company

The client is a mid-sized manufacturer whose production scheduling, warehouse and Kingdee finance systems share one SQL Server instance on a single Windows server, with database files and business attachments on the same disk.

To give branch plants and distributors access, port 1433 was mapped directly to the internet long-term, the sa account used a password that had not changed in years, and the service ran under an account with broad local privileges.

On Monday morning the shop floor reported that the ERP client would not log in. IT found the database service failing to start, data and log files carrying a new appended extension, and a ransom note on the desktop pointing to an email address. The backup job wrote to a second partition on the same server and was encrypted as well; an off-site backup approved the previous year had never actually been implemented.

Before calling us the client had already restarted the server and run a full antivirus scan, which moved the ransom note into quarantine.

Containment instructions went out on the first call: keep the server powered but off the network, stop all writes, pause every scheduled task, and make no further reboot or database repair attempt.

• Evidence and imaging. Read-only images of the system and data disks, plus Windows security logs, SQL Server error logs and firewall traffic records. All subsequent work ran on copies.
• Family confirmation. The ransom note was retrieved from quarantine; the extension, note text and contact format identified a Mallox build with no usable public decryptor, ruling out decryption.
• Recoverability assessment. The encryptor had skipped and partially written the large MDF file, leaving substantial untouched data pages in the middle and tail sections; transaction log files were comparatively lightly damaged.
• Recovery. Page-level scanning rebuilt the system and user table structures, usable pages were extracted table by table, and log replay filled in incremental records up to the outage. The result was exported to a fresh database. Most attachment files were recovered from unencrypted remnants and temporary directories.
• Hardening in parallel. The public 1433 mapping was removed in favour of VPN access with multi-factor authentication, all database and system passwords were reset, and backup credentials were separated from production.