Yanluowang

Yanluowang is a ransomware family active from at least 2021 through late 2022 that targeted organizations in the United States and elsewhere, including banks, telecommunications providers, engineering firms, and other enterprises. It is associated with double-extortion operations in which operators encrypted victim data, stole information prior to encryption, and threatened public disclosure on leak sites if payment was not made. Reported coercive tactics also included harassing phone calls and distributed denial-of-service pressure against victims during negotiations. Ransom demands ranged from hundreds of thousands to many millions of dollars in cryptocurrency.

The operation relied on an affiliate-style division of labor that included initial access brokers who identified and exploited vulnerabilities in corporate networks, sold or shared unauthorized access with ransomware operators, and in some cases received a percentage of ransom proceeds. U.S. court cases tied Aleksei Volkov to providing access for multiple Yanluowang intrusions between July 2021 and November 2022. Public reporting also links the group to attempted extortion against Cisco. Researchers first publicly identified the family in 2021, and later reporting indicated the operators used a false Chinese persona to obscure their identities. The group is generally assessed to have disbanded in late 2022 after its leak site was compromised and internal chats were exposed. A weakness in the malware’s encryption scheme enabled release of a free decryptor in 2022.