WantToCry Ransomware Abuses SMB Services to Remotely Encrypt Files

Cybersecuritynews •Tushar Subhra Dutta • May 21, 2026

A ransomware strain called WantToCry has been targeting businesses by abusing a widely used file-sharing protocol to encrypt files without dropping any malware on the victim’s system. The attacks mark a notable shift in how ransomware operators approach campaigns, serving as a warning to any organization that still has file-sharing services exposed to the open […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WantToCry Ransomware Campaign Targets Exposed SMB Services for Remote Encryption The WantToCry ransomware campaign exploits exposed Server Message Block (SMB) services to remotely encrypt files without deploying malware on victim systems. Attackers scan for open SMB ports and use brute-force methods to gain access, leading to file exfiltration and encryption on their own servers. Ransom notes are left on affected systems, demanding payments ranging from $300 to $1,800 in Bitcoin. The campaign has been active since at least early 2024, with over 1.5 million devices identified as vulnerable. The ransomware's name is a nod to the infamous WannaCry ransomware, but it operates differently, focusing on remote encryption. Victims are instructed to communicate via qTox or Telegram for payment and decryption instructions. Security experts warn that paying the ransom does not guarantee file recovery. Organizations are advised to secure their SMB services to mitigate risks. 6 sources 70

Extracted Entities

WantToCry Ransomware Abuses SMB Services to Remotely Encrypt Files

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Ransomware Groups (1)