# WantToCry Ransomware — Remote SMB Encryption Campaign Targeting Internet-Exposed TCP 139/445 (Sophos CTU)

> Sophos Counter Threat Unit disclosed a WantToCry ransomware campaign in which operators brute-force internet-exposed SMB services on TCP 139/445, then read victim files over an authenticated SMB session, encrypt them on attacker-controlled infrastructure, and write the encrypted blobs back to the original share — producing a ransomware impact with no malware ever executing on the victim host. Encrypted files receive the .want_to_cry extension and a !Want_To_Cry.txt ransom note is dropped to affected shares, with ransom demands of $400-$1,800 (typically $600) negotiated over qTox or Telegram (@want_to_cry_team). Shodan identifies roughly 1.5 million devices exposing SMB to the internet, with the United States the most-exposed country.

- **Published:** 2026-05-19T12:00:00Z
- **Last reviewed:** 2026-05-19T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0531
- **ID:** TL-2026-0531
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** WantToCry operators
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WantToCry is a financially motivated ransomware operation that has been active since at least December 2023, but Sophos Counter Threat Unit (CTU) published a deep technical analysis on 2026-05-19 detailing a novel remote-encryption tradecraft that the operators have refined in 2025-2026. Unlike conventional ransomware that requires a binary to execute on the victim endpoint, WantToCry weaponises the SMB (Server Message Block) protocol itself: the attacker brute-forces credentials against internet-exposed SMB services on TCP 139 and 445, authenticates as a legitimate user, opens a session to writable shares (commonly NAS appliances, file servers, and small-business storage), reads the victim files over SMB to attacker infrastructure, encrypts them there, and writes the encrypted result back to the original share via the same SMB session. The technique is architecturally similar to a man-in-the-middle file rewrite and intentionally eliminates the local malware footprint that EDR and CryptoGuard-style behavioural engines rely on.

The brute-force stage is automated and high-volume. Multiple vendors (Sophos, Seqrite, Quick Heal) report that the actors maintain a curated database of over one million credentials spanning common defaults, leaked password lists, and previously breached accounts, and target not only SMB but also SSH, FTP, RPC, and VNC where they are exposed. Once authenticated, the operators enumerate shares, identify file types of interest, and run their remote-encryption tooling. Sophos telemetry traced the operations to a series of ISPsystem-managed virtual machines repurposed through bulletproof hosting, with computer names WIN-J9D866ESIJ2 (Windows Server 2016) and WIN-LIVFRVQFMKO (Windows Server 2019) — VM names that have also appeared in unrelated NetSupport RAT, LockBit, Qilin, and BlackCat operations, suggesting a shared bulletproof-hosting estate rather than direct actor overlap.

Victim files are renamed with a .want_to_cry suffix (e.g. quarterly_report.xlsx → quarterly_report.xlsx.want_to_cry) and a ransom note titled !Want_To_Cry.txt is dropped at the root of each affected share. Two ransom note variants have been observed: an earlier variant directed victims to a qTox ID (963E6F7F58A67DEACBC2845469850B9A00E20E4000CE71B35DE789ABD0BE2F70D4147D5C0C91), and a later variant directing victims to https://t.me/want_to_cry_team on Telegram. Operators offer to decrypt up to three sample files as a proof of capability. Observed ransom demands range from US$400 to US$1,800, clustered around US$600 — a low-value, high-volume model consistent with the opportunistic brute-force targeting pattern.

The campaign is not self-propagating and contains no exploit-based initial access. Despite the name, WantToCry has no technical relationship to WannaCry/WCry (2017): there is no MS17-010 / EternalBlue worm component, no kernel-level shellcode, and no kill-switch domain. The name appears to be a deliberate homage chosen for psychological effect on victims. Equally, no double-extortion or data leak site has been associated with WantToCry — the operators monetise exclusively through decryption sales.

The defensive impact is significant because the entire encryption operation can occur with the victim host showing nothing more than a series of SMB READ and WRITE operations from an authenticated session. Traditional anti-ransomware controls (CryptoGuard, Controlled Folder Access, on-host behaviour rules) cannot trigger because no process on the victim is performing the encryption. Detection must shift to (a) SMB session-level analytics (unusual file-rename patterns, mass write-with-extension-change), (b) authentication telemetry (geo-anomalous SMB logons, brute-force lockouts), and (c) external attack surface management to remove TCP 139/445 from the internet entirely. As of 2026-01-07, Sophos cites Shodan data showing ~1.5 million devices exposing SMB to the public internet, with the United States, China, Hong Kong, and Russia accounting for the majority. Small and mid-size organisations, ISPs, and NAS-heavy environments (Synology, QNAP, TrueNAS) face the highest risk.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.001 Active Scanning: Scanning IP Blocks
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1583.004 Acquire Infrastructure: Server
- T1078 Valid Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1133 External Remote Services
- T1110.001 Brute Force: Password Guessing
- T1110 Brute Force
- T1110.004 Brute Force: Credential Stuffing
- T1135 Network Share Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1020 Automated Exfiltration
- T1048 Exfiltration Over Alternative Protocol
- T1564 Hide Artifacts
- T1070.004 Indicator Removal: File Deletion
- T1071 Application Layer Protocol
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1486 Data Encrypted for Impact
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1490 Inhibit System Recovery

## Sources

- [WantToCry ransomware remotely encrypts files (Sophos Counter Threat Unit)](https://www.sophos.com/en-us/blog/wanttocry-ransomware-remotely-encrypts-files)
- [WantToCry Ransomware Exploits SMB Vulnerabilities to Remotely Encrypt NAS Drives](https://cybersecuritynews.com/wanttocry-ransomware/)
- [Exposed SMB: The Hidden Risk Behind WantToCry Ransomware Attacks](https://www.seqrite.com/blog/wanttocry-ransomware-smb-vulnerability/)
- [Exposed SMB: The Hidden Risk Behind WantToCry Ransomware Attacks (Quick Heal)](https://www.quickheal.co.in/knowledge-centre/exposed-smb-risk-wanttocry-ransomware/)
- [What is WantToCry Ransomware? (Elastio)](https://elastio.com/ransomware-detection/wanttocry)
- [Robust identification of ransomware encryption over SMB (Darktrace)](https://www.darktrace.com/research/robust-identification-of-ransomware-encryption-over-smb)
- [WantToCry Ransomware Exploits SMB Vulnerabilities: A Serious Cybersecurity Threat (NPAV)](https://blogs.npav.net/blogs/post/wanttocry-ransomware-exploits-smb-vulnerabilities-a-serious-cybersecurity-threat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0531