Transcript
All the way back in 2017, the eternal blue exploit leaked from the NSA by the Shadow Brokers. It led to hospitals locked, factories shut down, and the NHS grinding to a halt. WannaCry Ransomware sounds like the same thing, but it isn't. WannaCry needed an exploit to run, and WannaCry just needs a password. It leaves no local execution trace, no binary on disk, and nothing for your endpoint agent to catch. And right now, 1.5 million devices on the public internet are exposed to it. So, the interesting question here is, how do you encrypt someone's files without running anything on their machine? When we picture ransomware, we picture a classic payload. Something like Lockbit or Blackcap. A binary lands on your disk, chews through your files, CPU pegs, and a ransom note hits the screen. WannaCry doesn't really do that. The encryption here happens on the attacker's server, hundreds or sometimes even thousands of miles away. So, with that in mind, you must be thinking, well this is a super targeted carefully listed chosen victims, right? Well no, it's actually mass scanning with automated backend processes. So, let's take a look at exactly how WannaCry works, because I think it's the start of a trend we are going to see a lot more of when it comes to ransomware in 2026. The whole thing here rides on SMB. TCP ports 139 and 445. Just quickly, SMB is how Windows shares files across a network. Port 445 is direct SMB over TCP, and 139 is the Aldernet Biosession port. Neither are designed to face the public internet. Microsoft and CISA have said so for years, but millions of them are misconfigured, as you can imagine, and do anyway. But the thing here is that attackers don't even need to sweep the whole IPv4 space themselves. They have services that can do that for them, services that you've probably heard of. Shodan and Census have already indexed every open port on the internet. So, search port 445, filter by country, and get a target list in seconds. Our CTU team at Sophos pulled the country breakdown straight from Shodan, and that's where the 1.5 million number comes from. Then, it's brute-forcing time. Running standard auth requests against the SMB service using tools that hammer common credentials from old breaches. In a normal ransomware attack, the victim's CPU pegs at 100% while files get encrypted. With one to cry, the CPU stays nice and calm, but what spikes is the network bandwidth in both directions. The attacker uses the stolen creds, opens an authenticated SMB session, and starts reading the files. The files get shuttled out to their own infrastructure, encrypted server-side with their own keys, and then written back over the original files through the same session. To understand why this matters beyond one ransomware family, I spoke to Rafe Pilling, Director of Threat Intelligence in our Sophos Counter Threat Unit, about what this technique tells us about where ransomware is heading. So Rafe, thanks for joining me today. When people hear ransomware, they usually imagine a malicious file running on a machine and actually doing the encryption. How has that mental model changed in 2026, and what does one to cry reveal about modern ransomware? Great question, thank you. So that mental model is still very much valid. In the vast majority of cases, that is still how ransomware is working. But there are campaigns like one to cry that do things a little differently. And I think one of the key things it demonstrates, and one of the sort of insidious parts of this attack, is the encryption is actually happening remotely on a different system, an unmanaged remote system. I think in the vast majority of cases, not on the same network as the organization that's been attacked. So it's a case of what we call remote ransomware. The system that's been encrypted has been accessed from this remote system where the malware is running. And it's just the files that are getting encrypted on those systems. From the victim's process monitoring point of view, this looks like a normal remote user reading and writing files over SMB. Because that's exactly what it is. When the encryption finishes, they drop a text file, wantocry.txt. Contact us on QDocs, which is a peer-to-peer encrypted messenger built on the TOX protocol. There's no central server here, so it's very hard to take down. Pay us $600 in Bitcoin. And yeah, $600 is ridiculously cheap for a ransomware. That's 100% deliberate here. One of the things that sort of stood out to me about wantocry and the specific piece of ransomware we're talking about here was that, in my mind, the ask for $600 is quite low. Now, in 2026, that might be the standard. But do you think that ransomware is splitting into sort of two tracks here? We've got, like, one traditional sort of Conti, Reval style ransomware, where they are asking for large amounts. And then more of a automated opportunistic one, where they're asking for that low amount in the hopes that people will just pay to make it go away? Yeah, I think in 2026, we actually have three major pillars of kind of ransomware activity. So the largest one is that opportunistic attacks on organizations, usually through unpatched services that are internet accessible, or some kind of identity authentication-related attack. Threat actor gets in, usually will steal data. And sometimes that's the basis for the kind of ransom demand or the extortionist, the extorting data. Often we'll also see that ransomware deployment and that actual sort of encryption tool is deployed to systems within the network and encrypts the ransomware there. And for the most part, those attacks are opportunistic, which is good news. But I'll come back to that in a second. Your second major pillar is those attacks where the threat actor is choosing the organization. And often we can determine this kind of thing because the attack comes from social engineering. So some of the attacks that we've seen in the last 12 months, particularly in the UK, where they've been against retail organizations, where social engineering was used to gain access to those organizations. So they didn't get phoned up opportunistically. Someone chose to make that phone call to those particular organizations. They've done some research. And so you get those sort of some threat actors will choose particular targets and go after those. And then the kind of last set, last pillar would be things like one to cry remote ransomware attacks where it's very likely they are using sort of Internet survey type tooling like census or showdown to identify exposed services from online storage like NAS network storage devices, for example, that they can remotely access and encrypt. And a lot of that will probably be automated once they've identified that that target list. Attacker infrastructure. And I love these breakdowns from our CTU team. They give you a real unique insight into how these ransomware gangs actually operate. The infrastructure here is segmented by job. So we've got recon scanning and the brute force attempts running out of a single Russian IP. The encryption work happens somewhere else entirely. So we've got five separate machines scattered across Germany, Russia, the US and two in Singapore. Keep scanning nodes up front and the encryption layer happening behind them. This is pretty standard ransomware OPSEC. If a firewall burns your scanners, then you can just spin up new ones. The encryption infrastructure here is obviously the real crown jewels. So it stays well back. But here's the part that should make you a little bit uncomfortable. The machines doing the encrypting here have standard names like WinJ9 and WinLI. These aren't really custom attacker host names. Their default naming patterns from a virtual machine that spun up by an ISP system. So a completely legitimate infrastructure management vendor. So think about what that means from a detection point of view for a second. Those exact computer names also show up in totally normal non-malicious activity. Because real customers run real VMs on the same platform. You can't block list the entire name. You can't alert on it because it's the same naming pattern that your own cloud boxes might have. And then it gets even murkier to track. These VMs get repurposed all the time. So you have bulletproof hosting providers leasing out legitimate vendor infrastructure to whoever's paying. So you have the same host name, WinLI, that's been spotted in LockBit, Quillion, and BlackHat campaigns. You've got WinJ9 that turned up in NetSupportRat activity. And this is probably the distinction that matters the most. Just because it's the same name doesn't mean it's the same box. And it definitely doesn't mean it's the same ransomware group. We need to remember it's a shared rental pool. So we have different actors cycling through the same disposable, legitimate-looking infrastructure. If you want to read more about this whole weird process, there's an article that I'm going to link below called The Malicious Use of Virtual Machine Infrastructure. Why detection is hard here. Okay, so while want to cry operations do generate observable network and authentication artifacts, traditional endpoint protection focuses on local processes. They monitor for suspicious binaries, mass file modifications by unknown applications, and CPU patterns that look a lot like crypto operations. Want to Cry sidesteps all of that, as there is no local processes to watch. With no unknown application running, the CPU never spikes. The thing doing the writing here is the SMB service itself, behaving exactly the way it's designed to, with valid credentials from a remote IP. That's not malicious behavior. So, what did catch it? In the Sophos telemetry was CryptoGuard. It doesn't really watch processes, it watches files. Encrypted output has a distinctive signature, high entropy. So when CryptoGuard sees mass file rewrites with that signature, it intervenes regardless of which process is doing the writing. How to fix. If you don't need SMB exposed to the internet, kill it. Block inbound port TCP 139 and 445 at your edge firewall. This is a CISA recommendation that goes back to 2017 after WannaCry, and it still hasn't been universally adopted. Disable anonymous SMB in guest authentication. Turn on SMB signing and SMB encryption for any sessions that you do allow, and put internal file shares behind a VPN or a zero trust gateway. Obviously monitor authentication logs for repeated SMB login failures against the same account from a single source. WannaCry is obviously riding off the coattails of WannaCry. But here's the question that it does leave me with. If an attacker automated a credential brute force and walked through your front door with valid logins, would your stack even notice? Check your perimeter, check your file activity logs, and don't be one of the 1.5 million.
