Tohnichi

Tohnichi, also known as Mallox, TargetCompany, and Fargo, is a ransomware strain that primarily targets Microsoft Windows systems. This malware first surfaced in June 2021 and has since claimed to have infected hundreds of organizations worldwide. The group behind this malicious software is associated with various other ransomware strains, signaling a broader threat landscape. Recently, the group has become increasingly active, indicating a significant shift in its operations. One of the primary attack vectors for Tohnichi is through vulnerable SQL servers running on targeted organizations' systems. The group has been actively exploiting these vulnerabilities, increasing the risk for businesses that use or run susceptible SQL servers. On August 10, 2023, it was reported that Tohnichi was actively targeting such organizations, further underscoring the escalating threat posed by this malware. In addition to its existing capabilities, the Tohnichi ransomware group recently unveiled a new variant of the malware along with several malicious tools for persistence and covert operations. These new developments are rapidly gaining traction and pose an increased threat to targeted organizations. The continued evolution and activity of the Tohnichi group suggest that it remains a significant cybersecurity concern.