Yanluowang

Yanluowang, also known as Dryxiphia, is a financially motivated, Russian-speaking ransomware operation active since at least August 2021 and first publicly identified in October 2021. It conducted human-operated attacks against enterprise organizations globally, with documented emphasis on U.S. financial institutions. Other targets included manufacturing, IT services, consultancy, engineering, and telecommunications organizations. The operation involved affiliates and initial access brokers, including Russian national Aleksei Volkov, who sold access to corporate networks used in subsequent ransomware attacks. Yanluowang intrusions combined reconnaissance, credential theft, lateral movement, data exfiltration, and file encryption. An observed affiliate used BazarLoader, PowerShell, RDP, and ConnectWise, together with AdFind and SoftPerfect Network Scanner for discovery. Credential-harvesting tools targeted browser passwords, KeePass master keys, and credentials stored in Veeam backup-management databases. Before encryption, the ransomware stopped hypervisor virtual machines and terminated running processes. Operators used stolen-data leak threats, leak sites, DDoS attacks, and harassing telephone calls to pressure victims, alongside threats of repeat intrusions and data deletion. Kaspersky identified an encryption weakness that enabled recovery through a known-plaintext attack and added Yanluowang support to RannohDecryptor. Internal communications, infrastructure information, and ransomware source code were exposed in late 2022, substantially disrupting the operation.