DearCry ransomware appends .CRYPT to forcibly encrypted files. (Source: Sophos)
Fresh ransomware targeting as-yet-unpatched on-premises Exchange servers appears to have been rushed to market, with attackers seeking to capitalize on new opportunities before the competition stepped in, security firm Sophos reports.
Sophos has published a teardown of the new DearCry ransomware, which it describes as being unsophisticated and apparently created by a beginner. The ransomware was first spotted in the wild on March 9.
DearCry targets a critical proxy-logon flaw in Microsoft Exchange email servers, which was one of four zero-day flaws Microsoft patched via software updates issued on March 2, when it warned that the flaws were already being exploited in the wild.