Important files encrypted and held for ransom: "Weaxor" ransomware cyberattacks remain active

Recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control Technology, relying on the National Computer Virus Collaborative Analysis Platform, discovered multiple incidents within China in which Chinese users suffered attacks by the "Weaxor" ransomware. After users' important files were encrypted, the file names were changed to the original file name plus a suffix string such as ".weax". At the same time, the attackers also left ransom notes on users' hosts, demanding that users contact them and pay a ransom. Tracing revealed that the relevant virus sample information is shown in the figure below. "Weaxor" ransomware has multiple versions, and attackers will deliver the corresponding ransomware program according to the type of target operating system, which can cover most Windows and Linux operating system platforms and poses a relatively large threat to both individual users and organizational users. "Weaxor" ransomware will leave a ransom note demanding that users contact it and pay a ransom.