Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: Dear Cry Ransomware

Summary: DearCry is a new ransomware variant observed exploiting the ProxyLogon vulnerabilities in Microsoft Exchange Servers for initial access, with ransom notes first reported on March 9, 2021 and suspected victims in the U.S., Canada and Australia. When executed, it encrypts files using AES-256 and RSA-2048, appends the string 'DEARCRY!' to file headers, runs a non-native service named 'msupdate' that is removed after encryption, and leaves a ransom note with two contact email addresses rather than a fixed Bitcoin demand.

Bottom line: Attackers moved from the four Exchange zero-days to a working ransomware payload while unpatched servers remained exposed, and DearCry's note asks victims to email the operators rather than pay a posted Bitcoin amount, leaving the extortion terms entirely in the attacker's hands.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026