Loading story…
Sophos reported that the WantToCry ransomware is targeting internet-exposed SMB services on ports 139 and 445, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the .want_to_cry extension and dropping ransom notes such as !want_to_cry.txt or !Want_To_Cry.txt. The notes direct victims to qTox or Telegram and typically demand about $600 in Bitcoin.
Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in Russia, Germany, the United States, and Singapore, including systems previously associated with NetSupport RAT and LockBit, Qilin, and ALPHV/BlackCat activity, while noting the ransomware is unrelated to the 2017 WannaCry worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable SMBv1 and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
SC Media summarized Sophos' findings, highlighting that WantToCry abuses exposed SMB services to encrypt files remotely and reduce host-based detection opportunities. The coverage emphasized defensive recommendations including blocking inbound SMB exposure, disabling SMBv1 and anonymous access, and monitoring unusual SMB activity from external IPs.
SophosLabs published research describing the campaign's use of segmented infrastructure and remote encryption, and noted related infrastructure in Russia, Germany, the United States, and Singapore. The company also reported overlaps with systems previously associated with NetSupport RAT and LockBit, Qilin, and ALPHV/BlackCat-related activity, while stating WantToCry is unrelated to the 2017 WannaCry worm.
In observed WantToCry intrusions, attackers authenticated to SMB shares, copied files to attacker-controlled servers for encryption, and wrote the encrypted files back to the original systems. Victims' files were renamed with the .want_to_cry extension and ransom notes such as !Want_To_Cry.txt were dropped, typically demanding about $600 in Bitcoin via qTox or Telegram.
Sophos said the WantToCry ransomware has existed since at least early 2024 and has been used against internet-exposed SMB services on ports 139 and 445. The attacks rely on weak, brute-forced, or stolen credentials rather than local malware execution on victim hosts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcesophos.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in **MS17-010**, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's **NHS**, **Telefónica**, **Iberdrola**, Russia's Interior Ministry, **FedEx**, and **Deutsche Bahn**, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of **$300** or **$600** in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as **Windows XP** as governments and incident responders urged organizations to report infections and patch exposed systems. Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the **DoublePulsar** backdoor, and used **EternalBlue** when DoublePulsar was absent to deliver the ransomware payload. WannaCry used **RSA-2048** and **AES-128** for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated **Windows 7** and **Windows Server 2008** accounted for most infections, while many **XP** systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.
Jun 29, 2026
Sophos researchers investigating late-2025 **WantToCry** ransomware incidents found repeated use of Windows virtual machines provisioned through **ISPsystem VMmanager**, where default images assigned static, autogenerated hostnames that were not randomized during deployment. Those identifiers appeared across thousands of internet-exposed **RDP** systems, heavily concentrated in Russia and nearby regions, and surfaced in operations tied to multiple malware and ransomware families including **LockBit**, **Qilin**, **BlackCat/ALPHV**, **Conti**, **TrickBot**, **Ursnif**, and **NetSupport RAT**. The report says the pattern does not prove a single shared operator, because unrelated actors can inherit the same hostnames and artifacts simply by using the same VM template. Sophos also found many of the exposed systems clustered at hosting providers including **Stark Industries Solutions Ltd** and **First Server Limited**, both previously linked in public reporting and sanctions to Russian state-connected or criminal activity, alongside underground advertising for bulletproof hosting and leased RDP access. Researchers concluded that **ISPsystem VMmanager** is legitimate software, but its low-cost, turnkey deployment model and common default configurations have made it attractive infrastructure for ransomware, malware delivery, phishing, botnet management, and data staging.
Jun 29, 2026
**WhiteLock** ransomware has been identified targeting Windows systems, encrypting files and appending the `.Fbin` extension before dropping a ransom note named `c0ntact.Txt` and changing the victim’s wallpaper to increase pressure to pay. During execution, the malware contacts an external server, derives a victim identifier by hashing the device’s MAC address, retrieves an RSA public key, and encrypts files with **AES-CBC** while protecting the AES key with **RSA-2048**. The operation also attempts to hinder containment by checking for **AnyDesk** and **TeamViewer** and terminating their services while encryption is underway. The ransom note claims both file encryption and data theft, threatens to publish or sell stolen data if payment is not made, and directs victims to a Tor-based negotiation page. Reporting also links WhiteLock activity to campaigns where information-stealing malware was used for initial access before ransomware deployment, underscoring the need to monitor abnormal outbound connections, remote access tool activity, mass file changes, ransom note creation, and service termination behavior.
Jul 8, 2026