Dearcry ransomware Targets Microsoft Exchange

dearcry ransomware, dearcry malware, dearcry ransomware ioc, dearcry exchange, dearcry ransomware exchange, ransomware

Microsoft has confirmed that a threat actor is exploiting vulnerabilities in ProxyLogon to install ransomware on unpatched Microsoft Exchange email servers and encrypt their content.

When Dearcry ransomware released?

The attacks have occurred since at least Tuesday, March 9, and were discovered after victim organizations uploaded copies of the ransom note to ID-Ransomware, a web-based tool to identify the name of the ransomware chain that encrypted the victim's systems.

What Dearcry ransomware can do?

It makes a service (named "msupdate" ) that is being used to start the encryption that can generate ".CRYPT" extension coming from IPs of Exchange servers from US, CA, AU on quick look.

DEARCRY ransomware name chosen based on a file marker found inside encrypted files; however, Microsoft Defender will also detect it as Ransom:Win32/DoejoCrypt.A.

Microsoft said "We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers. Microsoft protects against this threat known as Ransom:Win32/DoejoCrypt.A, and also as DearCry."


Next Post Previous Post