WantToCry Ransomware Leverages Exposed SMB for Remote Encryption Loops

Sophos CTU describes "WantToCry", a ransomware campaign that discovers internet‑exposed SMB servers, brute‑forces credentials, and performs remote file reads, encrypts files on attacker infrastructure, then writes encrypted files back to victims—achieving destruction without executing local malware. The report includes tracked IPs and hostnames, ransom note behavior (qTox/Telegram and Bitcoin/USDT addresses), and highlights the challenge this technique poses to traditional EDRs because no malicious binaries or local processes are observable.