Chinese cybersecurity center warns of Weaxor ransomware attacks targeting Windows, Linux systems
China's National Computer Virus Emergency Response Center has recently detected multiple cases of Weaxor ransomware attacks targeting users in China, and urged internet users and network operators, particularly small and medium-sized network operators, to strengthen their cybersecurity defenses.
The Weaxor ransomware family has multiple variants, with attackers deploying different programs based on the target operating system. It can run on most Windows and Linux platforms, posing significant threats to both individual and organizational users, the center said.
The ransomware family has been active in China and globally in recent months, primarily targeting corporate databases, office automation (OA) systems and other business systems. It does not spread autonomously. Instead, cybercriminals typically deploy it into target internal networks after gaining unauthorized access, either automatically or manually, according to the center.
Attackers mainly exploit weak passwords or vulnerabilities in systems and software to breach servers, before deploying ransomware through PowerShell scripts, remote-control tools, and other methods to encrypt files.
An infection could result in severe data damage and financial losses for businesses and individuals. The Windows variant also has malicious functionality that can steal locally stored Windows system and domain login credentials, which attackers could use to conduct further intrusions into the target's internal network and cause greater damage.
Without the decryption key, there is currently no reliable way to recover data encrypted by the ransomware, the center said. It also warned that purported ransomware decryption tools circulating online could be scams that expose users to secondary malware infections.
With the assistance of artificial intelligence (AI), cybercriminals can overcome barriers related to language, specialized knowledge and attack techniques, as well as human limitations involving time zones and working hours, enabling them to launch sustained cyberattacks against targets worldwide. The automation and technical sophistication of such attacks have increased significantly, the center said.
In response to AI-enhanced cyberattacks, the center urged internet users and network operators to strengthen their cybersecurity defenses, employ professional cybersecurity personnel and, where appropriate, engage specialized cybersecurity service providers.
The center particularly urged small and medium-sized network operators to conduct regular security checks on their information systems and hosts to ensure that protective measures are properly implemented. These include managing firewalls and remote access, minimizing the number of open ports, changing passwords regularly, and promptly installing security patches.
Global Times
The Weaxor ransomware family has multiple variants, with attackers deploying different programs based on the target operating system. It can run on most Windows and Linux platforms, posing significant threats to both individual and organizational users, the center said.
The ransomware family has been active in China and globally in recent months, primarily targeting corporate databases, office automation (OA) systems and other business systems. It does not spread autonomously. Instead, cybercriminals typically deploy it into target internal networks after gaining unauthorized access, either automatically or manually, according to the center.
Attackers mainly exploit weak passwords or vulnerabilities in systems and software to breach servers, before deploying ransomware through PowerShell scripts, remote-control tools, and other methods to encrypt files.
An infection could result in severe data damage and financial losses for businesses and individuals. The Windows variant also has malicious functionality that can steal locally stored Windows system and domain login credentials, which attackers could use to conduct further intrusions into the target's internal network and cause greater damage.
Without the decryption key, there is currently no reliable way to recover data encrypted by the ransomware, the center said. It also warned that purported ransomware decryption tools circulating online could be scams that expose users to secondary malware infections.
With the assistance of artificial intelligence (AI), cybercriminals can overcome barriers related to language, specialized knowledge and attack techniques, as well as human limitations involving time zones and working hours, enabling them to launch sustained cyberattacks against targets worldwide. The automation and technical sophistication of such attacks have increased significantly, the center said.
In response to AI-enhanced cyberattacks, the center urged internet users and network operators to strengthen their cybersecurity defenses, employ professional cybersecurity personnel and, where appropriate, engage specialized cybersecurity service providers.
The center particularly urged small and medium-sized network operators to conduct regular security checks on their information systems and hosts to ensure that protective measures are properly implemented. These include managing firewalls and remote access, minimizing the number of open ports, changing passwords regularly, and promptly installing security patches.
Global Times
RELATED ARTICLES
