Back Insight.Scmagazineuk

New WantToCry ransomware evades detection by encrypting files remotely

Insight.Scmagazineuk • May 21, 2026

An error occurred trying to play the stream. Please reload the page and try again.

Registering with SC Media is 100% free. Join tens of thousands of cybersecurity leaders today and gain access to the latest analysis shaping the global infosec agenda.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WantToCry Ransomware Campaign Targets Exposed SMB Services for Remote Encryption The WantToCry ransomware campaign exploits exposed Server Message Block (SMB) services to remotely encrypt files without deploying malware on victim systems. Attackers scan for open SMB ports and use brute-force methods to gain access, leading to file exfiltration and encryption on their own servers. Ransom notes are left on affected systems, demanding payments ranging from $300 to $1,800 in Bitcoin. The campaign has been active since at least early 2024, with over 1.5 million devices identified as vulnerable. The ransomware's name is a nod to the infamous WannaCry ransomware, but it operates differently, focusing on remote encryption. Victims are instructed to communicate via qTox or Telegram for payment and decryption instructions. Security experts warn that paying the ransom does not guarantee file recovery. Organizations are advised to secure their SMB services to mitigate risks. 6 sources 70

Extracted Entities

New WantToCry ransomware evades detection by encrypting files remotely

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (1)