MalwareRansomware

WantToCry

WantToCry is a ransomware strain observed since at least early 2024 and investigated by SophosLabs in late 2025. It targets organizations with internet-exposed Server Message Block (SMB) services, particularly hosts exposing TCP ports 139 and 445. Rather than executing a ransomware binary locally, operators scan for exposed SMB services, brute-force or use weak/compromised credentials, authenticate over SMB, exfiltrate files through the authenticated session to attacker-controlled infrastructure, encrypt the files remotely, and then write the encrypted versions back to the victim system. This remote-encryption workflow reduces host-based detection opportunities because it avoids local malware execution, suspicious processes, registry changes, and dropped binaries on the victim endpoint.

Observed effects include encrypted files being renamed with the .want_to_cry extension and ransom notes named !Want_To_Cry.txt being written to affected directories. Sophos observed ransom note variants directing victims to qTox or to the Telegram account hxxps://t[.]me/want_to_cry_team, offering decryption of up to three test files and payment to a unique Bitcoin wallet. In incidents investigated by Sophos, ransom demands were typically $600, while other publicly disclosed notes ranged from roughly $400 to $1,800. Sophos found no evidence that WantToCry used stolen data for double extortion or name-and-shame extortion, and assessed that attacks often affected only the host exposing SMB rather than broader enterprise environments. Sophos also stated that WantToCry is not self-propagating and found no evidence connecting it to the 2017 WannaCry worm beyond the name similarity.

Sophos linked campaign activity to reconnaissance and brute-force activity from 87[.]225[.]105[.]217 and to encryption-phase infrastructure at 109[.]69[.]58[.]213, 185[.]189[.]13[.]56, 185[.]200[.]191[.]37, 194[.]36[.]179[.]18, and 194[.]36[.]179[.]30, geolocating to Germany, Russia, the United States, and Singapore. Recurrent attacker computer names included WIN-J9D866ESIJ2 and WIN-LIVFRVQFMKO, which Sophos identified as hostnames associated with virtual machines provisioned via ISPsystem VMmanager. Sophos and third-party reporting also observed those hostnames in other malicious activity, including NetSupport RAT and LockBit, Qilin, and BlackCat/ALPHV ransomware, but Sophos cautioned that hostname reuse alone does not prove the same device or actor. The content further notes that WantToCry activity has abused virtual machines provisioned through ISPsystem and delivered via abuse-tolerant or bulletproof hosting ecosystems at scale.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595.002Vulnerability ScanningEvidence1

Services such as Shodan and Censys continuously scan internet-facing systems, creating readily available databases of exposed services that attackers can leverage for target selection.

Initial Access

2 techniques

T1078Valid AccountsEvidence5

After successfully authenticating using compromised or weak credentials, the attackers initiated file exfiltration via authenticated SMB sessions.

T1133External Remote ServicesEvidence3

SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access...

Persistence

2 techniques

T1078Valid AccountsEvidence5

After successfully authenticating using compromised or weak credentials, the attackers initiated file exfiltration via authenticated SMB sessions.

T1133External Remote ServicesEvidence3

SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access...

Privilege Escalation

1 technique

T1078Valid AccountsEvidence5

After successfully authenticating using compromised or weak credentials, the attackers initiated file exfiltration via authenticated SMB sessions.

Stealth

3 techniques

T1070Indicator RemovalEvidence1

Because no untrusted binaries are executed, no malicious registry edits are created, and no unexpected system processes run locally on the target server, local anti-malware tools remain entirely blind to the destruction occurring across the network file shares.

T1070.004File DeletionEvidence1

The encrypted files were then written to the original locations on the victims’ systems via the same authenticated SMB sessions.

T1078Valid AccountsEvidence5

After successfully authenticating using compromised or weak credentials, the attackers initiated file exfiltration via authenticated SMB sessions.

Credential Access

1 technique

T1110Brute ForceEvidence5

In the attacks SophosLabs analysts observed, the threat actors automated brute-force attempts targeting SMB services exposed to the internet on ports 139 and 445.

Discovery

1 technique

T1046Network Service DiscoveryEvidence5

WantToCry operators identify potential victims by scanning the internet for open SMB ports. The threat actors likely use the same reconnaissance services as legitimate security teams. Services such as Shodan and Censys continuously scan internet-facing systems, creating readily available databases of exposed services that attackers can leverage for target selection.

Lateral Movement

2 techniques

T1021.001Remote Desktop ProtocolEvidence1

According to the Shodan search engine, the two hostnames were associated with thousands of internet-facing devices exposing RDP services (TCP port 3389) in December 2025.

T1021.002SMB/Windows Admin SharesEvidence1

The threat actors exploit internet-exposed Server Message Block (SMB) file-sharing services to silently extract, encrypt, and overwrite targeted network data from afar.

Collection

1 technique

T1074Data StagedEvidence1

The subsequent encryption process was initiated on the exfiltrated files stored on attacker-controlled infrastructure.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The infrastructure commonly supports ransomware command and control (C2) servers, malware distribution, phishing campaigns, botnet management, and data exfiltration staging.

T1105Ingress Tool TransferEvidence3

CTU researchers investigated the potential scale of malicious use of these devices and identified multiple internet-exposed systems associated with cybercriminal activity, including ransomware operations and commodity malware delivery.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

The remote servers systematically issue file-read requests to pull documents over the network, encrypt them locally on the attacker’s own hardware...

T1048Exfiltration Over Alternative ProtocolEvidence4

After successfully authenticating using compromised or weak credentials, the attackers initiated file exfiltration via authenticated SMB sessions. The subsequent encryption process was initiated on the exfiltrated files stored on attacker-controlled infrastructure.

T1567.002Exfiltration to Cloud StorageEvidence1

The subsequent encryption process was initiated on the exfiltrated files stored on attacker-controlled infrastructure.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence5

The subsequent encryption process was initiated on the exfiltrated files stored on attacker-controlled infrastructure. The encrypted files were then written to the original locations on the victims’ systems via the same authenticated SMB sessions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 month ago

uri●●●●●●●●●●●●View more in app1 month ago

ip.v4●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

security online infoNews

May 23, 2026

WantToCry Ransomware Leverages Exposed SMB for Remote Encryption Loops

Ransomware that encrypts victim files remotely over authenticated SMB sessions without executing malware locally on the target. The operators scan for internet-exposed SMB services, brute-force weak credentials, read files over the network, encrypt them on attacker-controlled systems, and write the encrypted files back, reducing local detection opportunities.

cyber security newsNews

May 21, 2026

WantToCry Ransomware Abuses SMB Services to Remotely Encrypt Files

Ransomware that abuses exposed SMB services for initial access, uses brute-force or compromised credentials, exfiltrates files to attacker-controlled infrastructure for remote encryption, then writes encrypted files back to the victim system. It appends the .want_to_cry extension and drops a !Want_To_Cry.txt ransom note.

scworldNews

May 20, 2026

WantToCry ransomware evades detection through SMB abuse, remote encryption | news | SC Media

Ransomware that targets exposed SMB services, gains authenticated SMB access via brute force or compromised credentials, exfiltrates files for remote encryption on attacker-controlled servers, and writes encrypted files back to victim systems to reduce endpoint detection.

sophos blogNews

May 19, 2026

WantToCry ransomware remotely encrypts files | SOPHOS

Ransomware that abuses exposed SMB services with weak or compromised credentials to gain access, exfiltrate files to attacker-controlled infrastructure for remote encryption, then writes encrypted files back over SMB and leaves ransom notes.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.