WantToCry Ransomware — Remote SMB Encryption Campaign Targeting Internet-Exposed TCP 139/445 (Sophos CTU) — Threadlinqs Intelligence
As of 2026-05-30, WantToCry Ransomware — Remote SMB Encryption Campaign Targeting Internet-Exposed TCP 139/445 (Sophos CTU) is a high-severity ransomware threat attributed to WantToCry operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0531 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: WantToCry operators · FINANCIAL
Sophos Counter Threat Unit disclosed a WantToCry ransomware campaign in which operators brute-force internet-exposed SMB services on TCP 139/445, then read victim files over an authenticated SMB
WantToCry is a financially motivated ransomware operation that has been active since at least December 2023, but Sophos Counter Threat Unit (CTU) published a deep technical analysis on 2026-05-19 detailing a novel remote-encryption tradecraft that the operators have refined in 2025-2026. Unlike conventional ransomware that requires a binary to execute on the victim endpoint, WantToCry weaponises the SMB (Server Message Block) protocol itself: the attacker brute-forces credentials against internet-exposed SMB services on TCP 139 and 445, authenticates as a legitimate user, opens a session to writable shares (commonly NAS appliances, file servers, and small-business storage), reads the victim files over SMB to attacker infrastructure, encrypts them there, and writes the encrypted result back to the original share via the same SMB session. The technique is architecturally similar to a man-in-the-middle file rewrite and intentionally eliminates the local malware footprint that EDR and CryptoGuard-style behavioural engines rely on.
The brute-force stage is automated and high-volume. Multiple vendors (Sophos, Seqrite, Quick Heal) report that the actors maintain a curated database of over one million credentials spanning common defaults, leaked password lists, and previously breached accounts, and target not only SMB but also SSH, FTP, RPC, and VNC where they are exposed. Once authenticated, the operators enumerate shares, identify file types of interest, and run their remote-encryption tooling. Sophos telemetry traced the operations to a series of ISPsystem-managed virtual machines repurposed through bulletproof hosting, with computer names WIN-J9D866ESIJ2 (Windows Server 2016) and WIN-LIVFRVQFMKO (Windows Server 2019) — VM names that have also appeared in unrelated NetSupport RAT, LockBit, Qilin, and BlackCat operations, suggesting a shared bulletproof-hosting estate rather than direct actor overlap.
Victim files are renamed with a .want_to_cry suffix (e.g. quarterly_report.xlsx → quarterly_report.xlsx.want_to_cry) and a ransom note titled !Want_To_Cry.txt is dropped at the root of each affected share. Two ransom note variants have been observed: an earlier variant directed victims to a qTox ID (963E6F7F58A67DEACBC2845469850B9A00E20E4000CE71B35DE789ABD0BE2F70D4147D5C0C91), and a later variant directing victims to https://t.me/want_to_cry_team on Telegram. Operators offer to decrypt up to three sample files as a proof of capability. Observed ransom demands range from US$400 to US$1,800, clustered around US$600 — a low-value, high-volume model consistent with the opportunistic brute-force targeting pattern.
The campaign is not self-propagating and contains no exploit-based initial access. Despite the name, WantToCry has no technical relationship to WannaCry/WCry (2017): there is no MS17-010 / EternalBlue worm component, no kernel-level shellcode, and no kill-switch domain. The name appears to be a deliberate homage chosen for psychological effect on victims. Equally, no double-extortion or data leak site has been associated with WantToCry — the operators monetise exclusively through decryption sales.
The defensive impact is significant because the entire encryption operation can occur with the victim host showing nothing more than a series of SMB READ and WRITE operations from an authenticated session. Traditional anti-ransomware controls (CryptoGuard, Controlled Folder Access, on-host behaviour rules) cannot trigger because no process on the victim is performing the encryption. Detection must shift to (a) SMB session-level analytics (unusual file-rename patterns, mass write-with-extension-change), (b) authentication telemetry (geo-anomalous SMB logons, brute-force lockouts), and (c) external attack surface management to remove TCP 139/445 from the internet entirely. As of 2026-01-07, Sophos cites Shodan data showing ~1.5 million devices exposing SMB to the public internet, with the United States, China, Hong Kong, and Russia acc
Weaknesses (CWE)
CWE-521, CWE-307, CWE-798, CWE-284
Target sectors: small-medium-business, managed-service-providers, hosting-providers, healthcare, education, manufacturing, professional-services, consumer-prosumer
Target regions: North America, Europe, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1595, T1595.001, T1595.002, T1592, T1583.003, T1583.004, T1078, T1078.003, T1133, T1110.001