Loading story…
Threat actors used the ProxyLogon Microsoft Exchange exploit chain, including CVE-2021-26855 and CVE-2021-27065, to compromise on-premises Exchange servers and deploy the DearCry ransomware, also tracked by Microsoft as DoejoCrypt. Researchers reported victims in multiple countries, and at least one victim was asked to pay $16,000. The activity followed earlier Exchange intrusions in which attackers had already planted web shells, reinforcing warnings that organizations should assume compromise even after applying Microsoft’s patches.
Analysis from CISA and Sophos shows DearCry is a relatively simple, human-operated Windows ransomware that encrypts files across connected drives using per-file AES-256 keys protected by a hard-coded RSA-2048 public key, appends encrypted metadata to files, renames them with the .CRYPT extension, and drops a readme.txt ransom note. CISA found the malware enumerates drives from A: through Z:, temporarily runs as a service named msupdate, overwrites originals with 0x41 before deletion, and includes contact emails konedieyp@airmail.cc and uenwonken@memail.com; Sophos also noted victim-specific builds, no need for command-and-control to start encryption, and a file-header format resembling WannaCry without evidence of a shared author.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
CISA published malware analysis report MAR-10330097 on April 12, 2021, documenting six DearCry samples, their encryption behavior, ransom note details, and YARA detection logic.
Sophos detected and blocked a DearCry ransomware attack against a customer network in Austria on March 13, 2021, after the same Exchange server had already been targeted with a webshell.
Sophos blocked webshell activity on an Austrian customer's Exchange server on March 11, 2021, two days before a DearCry ransomware attempt on the same system.
A victim reported on March 9, 2021, that their Microsoft Exchange server had been compromised through ProxyLogon and that DearCry was the payload.
Other DearCry samples later documented by CISA had compile timestamps on March 9, 2021, showing multiple closely related variants were built around the same time.
Michael Gillespie of ID-Ransomware began receiving victim submissions tied to DearCry on March 9, 2021, with most cases involving Microsoft Exchange servers.
Several DearCry samples analyzed later by CISA had compile timestamps on March 8, 2021, indicating active malware development before broad public reporting.
Microsoft released an out-of-band patch on March 3, 2021, after Volexity reported active exploitation of the Exchange vulnerabilities.
MSRC confirmed on February 18, 2021, that the Exchange bug would be fixed in the March 9 Patch Tuesday release.
Volexity assessed that attackers began exploiting the Exchange vulnerabilities in the wild as early as January 6, 2021, including deployment of ASPX webshells and follow-on post-exploitation activity.
DEVCORE contacted the Microsoft Security Response Center on January 5, 2021, and set a 120-day public disclosure deadline.
DEVCORE chained the Exchange bugs into a pre-authentication remote code execution exploit dubbed ProxyLogon on January 1, 2021.
DEVCORE researchers uncovered the Exchange vulnerabilities later used in the ProxyLogon chain and reported them to Microsoft in December 2020.
Microsoft security researcher Phillip Misner confirmed that DearCry, which Microsoft tracks as DoejoCrypt, was being installed in human-operated attacks using the Exchange exploits.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourceus-cert.cisa.gov
Open sourcebleepingcomputer.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Kingdom ransomware was deployed against unpatched on-premises Microsoft Exchange servers after attackers exploited the **ProxyLogon** chain, particularly `CVE-2021-27065`, and installed web shells for remote access. Reporting from multiple security firms says the operators used shells including `ChackLogsPL.aspx`, `ckPassPL.aspx`, `hackIdIO.aspx`, and in some cases **China Chopper**, then launched the payload through PowerShell, WMI, and downloads from infrastructure such as `yuuuuu44[.]com`. Trend Micro also linked ProxyLogon exploitation to other malware families including **LemonDuck** and **Prometei**, showing that Exchange compromises quickly became a shared delivery path for ransomware, coinminers, and botnets. Researchers described Black Kingdom as a relatively crude Python ransomware built with **PyInstaller**, but still disruptive: it encrypted files, could encrypt them multiple times, stopped SQL-related services, deleted Windows Event Logs, and displayed a ransom note demanding **$10,000 in Bitcoin**. Analysis found the malware uploaded victim IDs and encryption keys to **Mega**, but fell back to a hardcoded key if that failed, creating a significant cryptographic weakness that may allow recovery in some cases. Additional reporting tied the campaign to random encrypted-file extensions, shared payment infrastructure, possible data-theft extortion claims, and at least one likely ransom payment, while analysts assessed the Exchange attacks as largely opportunistic rather than confidently attributable to a known threat actor.
Aug 15, 2026
The **Play ransomware** group, also tracked as **PlayCrypt** and attributed by Symantec to **Balloonfly**, has conducted double-extortion intrusions since 2022 while refining both its initial access and post-compromise tradecraft. Symantec reported the group exploited Microsoft Exchange flaws **`CVE-2022-41080`** and **`CVE-2022-41082`**, then used newly observed custom .NET utilities to accelerate victim profiling and data access before encryption. One tool, **Grixba**, surveys domain users, computers, software, services, security products, backup platforms, and remote administration tools, and can also clear logs on local and remote systems; another uses the **AlphaVSS** library to copy files from **Volume Shadow Copy Service** snapshots, including files normally locked by the operating system. Reverse-engineering of the Play encryptor shows a ransomware family built for enterprise attacks, using a hybrid **RSA-AES** scheme, heavy obfuscation, API hashing, and anti-analysis techniques. The malware has been linked with tools and access methods including **SystemBC RAT**, **Cobalt Strike**, **AdFind**, **WinPEAS**, **WinSCP**, **RDP**, and **SMB**, and it enumerates local and network drives, skips selected files and directories, encrypts files in size-based chunks, appends the **`.PLAY`** extension, and drops a **`ReadMe.txt`** ransom note. Researchers also noted a coding flaw that can cause files to be renamed even when encryption does not complete successfully, underscoring both the malware’s sophistication and its ongoing evolution.
Aug 15, 2026
Sophos reported that the **WantToCry** ransomware is targeting internet-exposed SMB services on ports `139` and `445`, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the `.want_to_cry` extension and dropping ransom notes such as `!want_to_cry.txt` or `!Want_To_Cry.txt`. The notes direct victims to qTox or Telegram and typically demand about **$600 in Bitcoin**. Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in **Russia, Germany, the United States, and Singapore**, including systems previously associated with **NetSupport RAT** and **LockBit, Qilin, and ALPHV/BlackCat** activity, while noting the ransomware is unrelated to the 2017 **WannaCry** worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable **SMBv1** and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.
Jun 29, 2026