Day 11: Yanluowang Ransomware

Yanluowang ransomware first performs a reconnaissance operation using AdFind to access information to move within the victim’s networks. The threat actors implement a malicious tool to create a .txt file with the remote machines to check in the command line, gather a list of processes running on remote machines using Windows Management Instrumentation (WMI), and log the processes and remote machine names to processes.txt. After the malicious tool is deployed, the Yanluowang ransomware will stop the hyper virtual machine ending the precursor tool (including SQL and Veeam) harvesting process and use the “.yanluowang” extension to encrypt the files. The group then leaves a ransom note marked README.txt on the encrypted system warning victims not to contact ransomware negotiation companies or law enforcement. If the victims break the rules, the threat actors implement a Distributed Denial-of-Service (DDoS) attack against them and contact the employees and business partners.