Exchange servers first compromised by Chinese hackers hit with ransomware

EnlargeGetty Images

Now organizations using Microsoft Exchange have a new security headache: never-before seen ransomware that’s being installed on servers that were already infected by state-sponsored hackers in China.

Microsoft reported the new family of ransomware deployment late Thursday, saying that it was being deployed after the initial compromise of servers. Microsoft’s name for the new family is Ransom:Win32/DoejoCrypt.A. The more common name is DearCry.

We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers. Microsoft protects against this threat known as Ransom:Win32/DoejoCrypt.A, and also as DearCry.

— Microsoft Security Intelligence (@MsftSecIntel) March 12,

→ Continue reading at Ars Technica

Related articles


Share article

Latest articles