WantToCry Ransomware Exploits SMB to Encrypt Remote Files

A new ransomware campaign named “WantToCry” that leverages exposed Server Message Block (SMB) services to gain access and encrypt victim data without deploying traditional malware on compromised systems.

This approach significantly reduces the detection surface, making it harder for conventional security tools to identify the attack.

The name “WantToCry” appears to reference the infamous WannaCry ransomware outbreak of 2017, which spread באמצעות an SMB vulnerability.

However, Sophos notes that WantToCry is not self-propagating and shows no technical link to WannaCry. Despite this, organizations with internet-facing SMB services remain at similar risk due to weak configurations and poor access controls.

According to the analysis, attackers begin by scanning the internet for devices exposing SMB ports, specifically TCP ports 139 and 445.

They likely rely on publicly available reconnaissance platforms such as Shodan and Censys, which index internet-exposed systems.

As of early 2026, more than 1.5 million devices were found to have SMB ports accessible online, providing a large attack surface.

SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access and then exfiltrating files to attacker-controlled infrastructure for remote encryption. 

Once potential targets are identified, attackers perform automated brute-force attacks to gain access using weak or compromised credentials.

After successful authentication, the attackers do not deploy malware locally. Instead, they initiate file exfiltration directly over SMB sessions, transferring victim files to attacker-controlled infrastructure.

WantToCry Ransomware Exploits SMB

The encryption process occurs remotely on attacker systems. Once files are encrypted, they are written back to the victim’s machine using the same SMB connection.

Encrypted files are appended with the “.want_to_cry” extension, and ransom notes named “!Want_To_Cry.txt” are dropped in affected directories.

This method eliminates the need for malicious binaries on the endpoint, bypassing many endpoint detection and response (EDR) mechanisms.

Sophos observed two variants of ransom notes, offering communication via qTox or Telegram. Victims are typically asked to pay around $600 in Bitcoin, although some cases show demands ranging from $400 to $1,800.

Unlike modern ransomware operations, there is no evidence of double extortion or data leak threats. The attacks appear limited in scope, often affecting only the exposed system rather than spreading laterally across networks.

The infrastructure used in these attacks is segmented. Initial reconnaissance and brute-force attempts were linked to an IP address associated with a Russian hosting provider.

Separate systems located across multiple countries, including Germany, the United States, Singapore, and Russia, were used during the encryption phase.

Researchers also identified recurring virtual machine hostnames such as WIN-J9D866ESIJ2 and WIN-LIVFRVQFMKO, which have been previously associated with other malware campaigns including LockBit and BlackCat.

However, these systems are likely rented virtual machines, not unique identifiers of a single threat actor.

Detection remains challenging because WantToCry does not rely on executable malware or suspicious processes.

Traditional antivirus and EDR tools, which depend on behavioral analysis and signature detection, may fail to detect such activity. Additionally, SMB-based file operations are generally considered legitimate system behavior.

However, the attack does leave network-level indicators. Unusual SMB activity, such as sustained file read and write operations from external IP addresses or abnormal authentication attempts, can signal ongoing attacks.

Tools that monitor file content changes, such as encryption detection technologies, can also identify and mitigate the impact.

Sophos emphasizes that prevention is critical. Organizations should disable SMBv1, block inbound SMB traffic at firewalls, enforce strong authentication, and ensure backups are not accessible عبر SMB.

Monitoring network activity and implementing XDR solutions can also provide early warnings of reconnaissance and brute-force attempts.

The WantToCry campaign highlights how attackers are shifting toward stealthier techniques that exploit misconfigurations rather than software vulnerabilities, reinforcing the importance of securing exposed services and strengthening authentication controls.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.