Makop Ransomware Decryption & Data Recovery

Makop was launched in January 2020 by a developer using the handle Makop, who recruited affiliates under a RaaS model; a series of same-lineage variants followed, including Oled, Mammon, Tomas and Harmagedon. Vendors disagree on its taxonomy: some research calls it a Phobos branch, but by payload implementation and operator it functions as an independent family — which matters operationally, because the official Phobos decryptor does not work on Makop.

China context: Makop is one of the most consistently present families domestically. 360's 2025 reports put it at roughly 14.29% of infections in January and 15.51% in March, near the top for much of the year, and note that it "spreads primarily by brute-forcing remote desktop passwords for manual deployment, with encrypted files given the mkp suffix".

Through 2026 its domestic share has clearly receded: the family rankings in 360's July and August 2026 monthly reports are led by Weaxor (65.74% in August), BrzCrypt and LockBit, with Makop no longer among the leaders, though it stays on 360's actively monitored keyword list and still turns up in individual incident response.

The affiliate toolchain has recognisable traits: multiple research teams recorded PowerShell downloading and running batch scripts, NS.exe for network and share scanning, Everything.exe for fast filename enumeration, and bring-your-own-vulnerable-driver techniques to disable security products. Victims are mainly servers at smaller companies, especially where port 3389 is mapped to the internet, the application and database share a host, and backups live on a local partition.

The filename pattern is the key Makop indicator:

originalname.[8-char ID].[attacker email].suffix

For example order.xlsx.[A1B2C3D4].[xxx@cyberfear.com].mkp.

Common extensions: .makop, .mkp, .baseus, .tomas, .harmagedon, .oled, .mammon, .origami, .moloch and more. Affiliates choose their own suffix, so the list is long and keeps growing; an unfamiliar suffix on a filename matching the pattern above should point to Makop first.

Ransom note: readme-warning.txt (readme.txt in some builds), dropped into each encrypted directory and onto the desktop. This is the most direct way to separate Makop from Phobos and BeijingCrypt — Phobos uses info.txt plus info.hta, BeijingCrypt uses !RECOVER.txt / !HELP!.txt.

Intrusion and execution artefacts:

• Clustered RDP logon failures (4625) followed by one success (4624, logon type 10) in the security log.
• Scanning and enumeration tools such as NS.exe and Everything.exe present on the host.
• PowerShell downloading and executing batch scripts.
• Security products disabled via an abusable driver (driver-load records left by BYOVD).
• Database and backup services terminated, shadow copies deleted.

Brute-forced RDP followed by hands-on deployment is the mainstream Makop affiliate method. Vendor analyses agree that affiliates obtain initial access mainly through internet-exposed remote desktop, even harvesting usernames from the logon screen to target password guessing. 360's domestic reports likewise identify it as the family's main propagation method, and its July 2026 monthly report widens the description to "brute-forcing remote desktop and database passwords, then deploying by hand and pivoting inside the network" — an internet-facing database service (SQL Server, MySQL and similar) with weak credentials is just as viable an entry point.

A typical chain: scan for port 3389 and collect targets; brute-force administrator and similar accounts; escalate privileges and disable security products, including via BYOVD; use PowerShell to pull and run a batch script that drops the toolset; scan internal shares with NS.exe and enumerate files with Everything.exe; distribute the payload over shares and remote desktop; then terminate database and backup services, delete shadow copies and encrypt.

Some research also records affiliates using loaders such as GuLoader, indicating a wide spread of skill levels. For defenders the conclusion is the same: as long as 3389 is exposed with weak credentials, this chain completes.

Makop encrypts file contents with a symmetric cipher (public analyses describe AES-256-class encryption) and protects the key asymmetrically, per host, so recovery at the algorithm level is impossible without the attacker's private key.

Encryption and destructive behaviour: it terminates database, mail and backup-agent services before encrypting; encrypts local disks, mapped network drives and reachable SMB shares, so NAS devices and file servers are commonly caught; deletes volume shadow copies and restore points; explicitly targets database files (.mdf, .ldf, .bak, .dbf, .ibd); rewrites filenames as originalname.[8-char ID].[email].suffix and drops readme-warning.txt into each directory.

On large-file handling: public sources give no consistent account across builds, and affiliates run different payload versions, so testing is required — take database files and large archives, analyse the distribution and stride of encrypted blocks to determine whether encryption is partial or full, and only then judge repair feasibility. Platforms are primarily Windows.