WantToCry Ransomware Encrypts Files Remotely Through Exposed SMB Shares

Sophos reported that the WantToCry ransomware is targeting internet-exposed SMB services on ports 139 and 445, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the .want_to_cry extension and dropping ransom notes such as !want_to_cry.txt or !Want_To_Cry.txt. The notes direct victims to qTox or Telegram and typically demand about $600 in Bitcoin.

Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in Russia, Germany, the United States, and Singapore, including systems previously associated with NetSupport RAT and LockBit, Qilin, and ALPHV/BlackCat activity, while noting the ransomware is unrelated to the 2017 WannaCry worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable SMBv1 and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.