The joy of handing over a BRAVO database after encryption with .WEX

The joy comes when data returns to work, beyond “the files have been copied”

In Ransomware Recovery, a readable MDF file does not mean the database is usable. Results matter when SQL Server structures are sufficiently stable, business data can be queried, and BRAVO and its users confirm that workflows work again.

“Congratulations and thanks to @TUNGTEK — Tùng Nguyễn and the whole team for recovering the data and reactivating BRAVO!”

Accumulated experience improves recovery efficiency

In practical ransomware recovery for SQL Server, effectiveness comes from more than a tool or decryptor. It depends on quickly reading the current state, identifying impact patterns, understanding business data structures and prioritizing what brings the system back to a verifiable condition.

Earlier field cases involving Mallox / TargetCompany gave TUNGTEK valuable experience: how to examine files such as .mdf/.ldf, assess scattered damaged regions and understand dependencies between pages, metadata, allocation maps and business data, while recognizing that attaching a database does not establish successful recovery.

When facing .WEX, Ticket #1326 was therefore approached with existing expertise. Mallox experience shortened planning, improved RFC and brought early focus to the most valuable path: extraction → reconstruction → application validation in BRAVO.

From experience to efficiency

Faster identification: look beyond extensions and prioritize impact patterns on SQL Server and actual data.

More focused RFC: measure affected regions and assess prospects through page/extent structure, beyond file status alone.

Fewer recovery iterations: preserve the source, work on copies and prioritize business data.

Purposeful validation: verify the final results in BRAVO with actual users.

Technical case analysis: a large MDF with many scattered damaged regions

One image with the technical context of Ticket #1326

The image below summarizes the case: BRAVO / SQL Server, a sample of B8R2_ABC.mdf.wex, 215 affected regions, approximately 95% of the size outside encrypted regions and results validated in the application before handover.

5% affected does not mean “only 5% of data lost” — nor is the other 95% immediately usable

For databases, damage location matters as much as size. A small encrypted region in metadata, allocation maps, page chains, indexes or other critical structures can prevent SQL Server from attaching the entire database. Conversely, scattered damage with mostly valid data pages can make extraction/reconstruction more feasible than waiting for a decryptor.

Why does page / extent structure offer extraction opportunities?

In SQL Server architecture, data files such as .mdf/.ndf are divided into page 8 KiB; an extent contains 8 consecutive pages, totaling 64 KiB. Data, indexes and metadata occupy different pages, so ransomware affecting scattered regions may leave many readable pages. This provides a basis for assessing extraction beyond “SQL Server cannot attach the database”. ^[5]

Recovery is performed on copies of the original files

Case #1326 describes the workflow at a verifiable public level, while withholding TUNGTEK’s proprietary techniques, internal patterns and tools.

Ticket #1326’s strongest evidence: validation in BRAVO itself

The case required the customer to verify recovered data directly on TUNGTEK’s server before acceptance. For BRAVO, verification involved coordinated temporary installation/licensing and the necessary procedures under the customer’s authorization.

This is why TUNGTEK distinguishes between the proportion of usable structure/bytes and the proportion of genuinely usable business data.

.WEX is a notable WeaXor/Mallox indicator, but the extension alone cannot establish a family

On 17 April 2025, LevelBlue SpiderLabs reported that WeaXor is a modified version of Mallox and that their collected samples append the suffix .wex to encrypted files. SpiderLabs also recorded C2 infrastructure, “RECOVERY INFO” ransom notes, Onion webchat and sample hashes. ^[1]

Within the Mallox/TargetCompany ecosystem, Unit 42 and SentinelOne recorded a focus on Internet-exposed Microsoft SQL Server / ODBC, including brute force against weak passwords, PowerShell/WMI after access, attempts to stop SQL services, removal of recovery mechanisms and, in some campaigns, data theft before encryption. ^{[2] [3]}

Trend Micro also lists .mdf, .sql, backup files and infrastructure formats among the extensions targeted by TargetCompany/Mallox samples, alongside stopping multiple SQL Server services. ^[4]

WeaXor IOCs published by SpiderLabs

The indicators below are public IOCs observed by LevelBlue SpiderLabs in the 2025 WeaXor campaign. They are not established as present in Ticket #1326 without comparing logs/malware samples. Use them for threat hunting, SIEM/EDR and retrospective checks.

Additional artifacts to hunt on SQL servers

Immediate priorities for SQL Server / ERP after .WEX

Assess what ransomware changed before “repairing” original files

A ransomware extension does not necessarily mean every byte of a database became ciphertext. Nor can it be assessed by sight or renaming alone. Preserve the source, create a working copy, perform RFC and measure impact before choosing a recovery path.

Threat intelligence & technical documentation

1. LevelBlue SpiderLabs — “Proton66 Part 2: Compromised WordPress Pages and Malware Campaigns”, 17 April 2025. Identifies WeaXor as a modified Mallox variant, appending .wex, and publishes C2, Onion and SHA-256 indicators. Open source.
2. Palo Alto Networks Unit 42 — “Threat Group Assessment: Mallox Ransomware”. Describes targeting of insecure MS-SQL, brute force, PowerShell, WMI, SQL service stops, shadow copy deletion and double extortion. Open source.
3. SentinelOne — “Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises”, updated 27 April 2025. Describes RaaS, MS-SQL/ODBC exposure, brute force, PowerShell/WMIC and recent Mallox payloads. Open source.
4. Trend Micro Threat Encyclopedia — TargetCompany/Mallox. Records .mdf, .sql and multiple infrastructure file formats as targets, along with stopping SQL-related services. Open source.
5. Microsoft Learn — “Page and Extent Architecture Guide – SQL Server”. Pages are 8 KiB; an extent contains 8 consecutive pages, totaling 64 KiB. Open source.

Case data comes from Ticket #1326 internal records and acceptance documents. Customer identities, accounts, infrastructure, paths and sensitive technical details have been omitted or anonymized. Potentially identifying company names and filenames are replaced with placeholders such as ABC to protect the customer.