Sophos Details WantToCry Ransomware’s Remote SMB Encryption Attacks

Summary

SophosLabs says WantToCry operators brute-force exposed SMB services, exfiltrate files to attacker-controlled systems, encrypt them remotely, then write them back over SMB. The report details infrastructure, detection challenges and mitigations.

Key points

SophosLabs observed operators scanning for internet-exposed SMB services on TCP ports 139 and 445, then using automated brute-force attempts against services with weak or compromised credentials.
After gaining authenticated SMB access, attackers exfiltrated files to attacker-controlled systems, encrypted them remotely, and wrote the encrypted files back to victims over SMB, without executing malware locally.
WantToCry appends the .want_to_cry suffix to encrypted files and leaves notes named !Want_To_Cry.txt. SophosLabs observed a $600 ransom demand; there is no evidence that exfiltrated data was used for name-and-shame or double extortion.
SophosLabs observed separate infrastructure for reconnaissance and encryption. Shared virtual-machine names in other attacks do not establish that the same device or threat actor was involved.
Because the activity lacks local malware execution, process-based EDR and antivirus detection may be limited. Monitoring unusual external SMB read/write activity and file-content changes can help identify it.
Recommended defenses include blocking inbound SMB at internet-facing firewalls, disabling SMBv1, removing guest or anonymous access, and ensuring backups cannot be accessed over SMB.

Article Details

Attack Vectors: Scanning the internet for systems exposing SMB ports 139 and 445.
Automated brute-force attempts against exposed SMB services, followed by access using compromised or weak credentials.
Exfiltrating files through authenticated SMB sessions to attacker-controlled infrastructure.
Encrypting files on attacker-controlled systems and writing the encrypted files back to victims’ original locations through SMB.
Leaving a ransom note named !Want_To_Cry.txt and directing victims to communicate through qTox or a Telegram account.
Defensive Notes: Disable SMBv1, remove guest or anonymous SMB access, and block inbound SMB traffic on TCP ports 139 and 445 at internet-facing firewalls.
Ensure backups cannot be accessed through SMB.
Monitor for sustained SMB read and write activity from external IP addresses, unusual file-access volumes, and activity outside normal business patterns.
Use network-level controls and file-content monitoring to detect and respond to remote encryption activity.
Use XDR to identify reconnaissance and brute-force attempts against exposed SMB services.

Indicators of compromise

Type	Indicator	Context
IPV4	`109[.]69[.]58[.]213`	IP geolocating to Germany that SophosLabs identified among attacker-controlled systems used for the encryption phase.
IPV4	`185[.]189[.]13[.]56`	IP geolocating to the Russian Federation that SophosLabs identified among attacker-controlled systems used for the encryption phase.
IPV4	`185[.]200[.]191[.]37`	IP geolocating to the United States that SophosLabs identified among attacker-controlled systems used for the encryption phase.
IPV4	`194[.]36[.]179[.]18`	IP geolocating to Singapore that SophosLabs identified among attacker-controlled systems used for the encryption phase.
IPV4	`194[.]36[.]179[.]30`	IP geolocating to Singapore that SophosLabs identified among attacker-controlled systems used for the encryption phase.
IPV4	`87[.]225[.]105[.]217`	IP associated with a Russia-based hosting provider from which WantToCry reconnaissance and systematic authentication attempts originated.
URL	`hxxps[:]//t[.]me/want_to_cry_team`	Telegram contact URL listed in a WantToCry ransom-note template for communication with the threat actors.