China's virus response center reports multiple Weaxor ransomware attacks on users
In short
China's National Computer Virus Emergency Response Center and a national engineering laboratory said they found multiple cases of Chinese users hit by "Weaxor" ransomware. The center said that without the decryption key there is currently no reliable way to recover the encrypted data.
Read the full story 2 min read
China's National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention Technology said they have found multiple cases of Chinese users attacked with "Weaxor" ransomware inside China. They made the finding using the National Computer Virus Collaborative Analysis Platform (virus.cverc.org.cn). CLS and Jiemian carried the text, attributing it to CCTV News. [ 1 , 2 , 3 ]
After the attack, users' important files are encrypted and renamed with the original file name plus a suffix such as ".weax". The attackers also leave a ransom note on the user's host, asking the user to contact them and pay a ransom. [ 1 , 2 , 3 ]
Weaxor has several versions. The attackers deliver a ransomware program that matches the target's operating system type, and the versions cover most Windows and Linux platforms. The outlets said it poses a considerable threat to both individual and organisational users. [ 1 , 2 , 3 ]
IT Home, citing the center's post of 22 October, reported further details. The center said the Weaxor family has stayed active recently in China and worldwide, mainly targeting enterprise databases, OA office systems and other business systems. It has no function to spread on its own and is mainly delivered, automatically or manually, to the target's internal network by cybercriminals after they break in. [ 3 ]
The center said the attackers mainly get in by exploiting weak passwords or system and software vulnerabilities on servers, then drop the ransomware through PowerShell scripts and remote control tools. According to the center, the ransomware uses elliptic curve encryption for an AES key, AES to encrypt a ChaCha20 key, and ChaCha20 to encrypt the files. Depending on the version, the suffix is usually changed to .rox, .weax, .wxx, .wxr, .weaxor, .roxaew or .wax. [ 3 ]
The center said that without the decryption key there is currently no reliable way to recover data encrypted by this ransomware. It said "ransomware decryption tools" circulating online are scams that may carry a risk of secondary infection with trojans. It advised users, especially small and medium-sized network operators, to carry out regular "security maintenance" on their network information systems and hosts and to check that protections are in place. [ 3 ]
Why it matters
The center said the ransomware poses a considerable threat to both individual and organisational users and urged small and medium-sized network operators in particular to check their protections. It also warned that fake decryption tools online may carry trojans.
Key facts
- The National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention Technology found multiple cases of Chinese users attacked with "Weaxor" ransomware, using the National Computer Virus Collaborative Analysis Platform. [ 1 , 2 , 3 ]
- Encrypted files are renamed with the original file name plus a suffix such as ".weax", and the attackers leave a ransom note asking users to contact them and pay. [ 1 , 2 , 3 ]
- Weaxor has several versions, and attackers deliver a program matching the target's operating system, covering most Windows and Linux platforms. [ 1 , 2 , 3 ]
- According to IT Home, the center said Weaxor has stayed active in China and worldwide, mainly targeting enterprise databases, OA office systems and other business systems. [ 3 ]
- According to IT Home, the center said data encrypted by Weaxor currently has no reliable recovery method without the decryption key. [ 3 ]
Confirmed by several sources
- Nothing is confirmed by two independent outlets yet.
Still unclear
- How many users or organisations were attacked, and who they are. The documents say only "multiple cases" and give no number or names.
- Who is behind the attacks. IT Home cites the center as saying cybercriminals carry out the intrusions, but no document identifies them.
- The National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention Technology said they found multiple cases of Chinese users hit by "Weaxor" ransomware, which poses a considerable threat to individual and organisational users. Reported by a single source so far
- Weaxor renames encrypted files with the original name plus ".weax" or similar suffixes and leaves a ransom note demanding contact and payment. Reported by a single source so far