A new ransomware operation dubbed WantToCry that exploits exposed Server Message Block (SMB) services to remotely encrypt files.
Unlike traditional ransomware, which executes malicious code directly on a victim’s machine, WannaCry relies entirely on remote access to exfiltrate, encrypt, and rewrite data.
This technique significantly reduces the attacker’s footprint, leaving behind no local malware or post-compromise lateral movement for security teams to analyze.
The campaign shares a naming similarity with the notorious 2017 WannaCry worm, which also targeted SMB vulnerabilities.
However, WantToCry is not self-propagating, and there is no evidence linking the two distinct threat groups.
WantToCry Exploits SMB Remotely
The WantToCry operators begin their intrusion by launching automated brute-force attacks against systems with exposed TCP ports 139 and 445.
Attackers use weak or compromised credentials to establish an authenticated SMB session. Instead of dropping malware onto the victim’s server, the attackers quietly pull the target’s files to their own controlled infrastructure over the established connection.
The actual encryption happens entirely on the remote attacker’s machine. After locking the data, the threat actors use the same authenticated session to overwrite the victim’s original files with the newly encrypted versions.
Following the encryption phase, the attackers leave a ransom note named !Want_To_Cry.txt and append a .want_to_cry extension to all affected files.
The financial demands in these attacks are unusually low, ranging between $400 and $1,800, which likely reflects the limited scope of the host-level encryption.
Threat actors direct victims to contact them via QTox or a designated Telegram account to receive a unique Bitcoin wallet address.
Interestingly, while the attackers actively exfiltrate data to encrypt it, analysts have found no evidence of double-extortion tactics or threats to leak stolen information.
According to Sophos research, traditional endpoint detection and response (EDR) solutions struggle to detect WannaCry attacks effectively.
Most antivirus platforms rely on spotting malicious processes, analyzing unusual behavioral patterns, or flagging known malware signatures on the local machine.
Because WantToCry performs all malicious actions remotely and uses legitimate network protocols for file transfers, there are no suspicious local processes to terminate.
Security tools typically view these external file operations as standard administrative behavior, allowing the attackers to slip past conventional defenses unnoticed.
Defending against this remote encryption tactic requires a shift toward network-level controls and strict access management.
Administrators must prioritize basic hygiene by turning off the outdated SMBv1 protocol and removing guest or anonymous access across the environment.
Blocking inbound traffic on TCP ports 139 and 445 at the perimeter firewall is critical to stopping the initial access vector.
Finally, deploying tools that monitor for rapid changes in file content can help detect and halt unauthorized encryption activity, regardless of whether the process originates locally or externally.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 services to remotely encrypt files.){kind=link}