China's National Computer Virus Emergency Response Center warns: multiple "Weaxor" ransomware attacks found targeting users in China
China's National Computer Virus Emergency Response Center and the national engineering lab for virus prevention report multiple "Weaxor" ransomware attacks on users in China via their joint analysis platform. After encryption, files are renamed with extensions like .weax, .wxx, .wxr, .weaxor, .roxaew, and .wax, and a ransom note is left behind. The family has multiple variants covering Windows and Linux, is actively spreading in China and globally, and mainly targets enterprise databases, OA office systems, and other business systems — intruding via weak passwords or vulnerabilities, then deploying the ransomware with PowerShell scripts or remote-control tools. It has no self-propagation capability.
SOURCES
- IT之家2026-10-22 05:11