Security News > 2021 > March > New DEARCRY Ransomware is targeting Microsoft Exchange Servers

Threat actors are now installing a new ransomware called 'DEARCRY' after hacking into Microsoft Exchange servers using the recently disclosed ProxyLogon vulnerabilities.
Since Microsoft revealed earlier this month that threat actors were compromising Microsoft Exchange servers using new zero-day ProxyLogon vulnerabilities, a significant concern has been when threat actors would use it to deploy ransomware.
Tonight our fears became a reality, and threat actors are using the vulnerabilities to install the DearCry ransomware.
On March 9, a victim also created a forum topic in the BleepingComputer forums where they state their Microsoft Exchange server was compromised using the ProxyLogon vulnerabilities, with the DearCry ransomware being the payload. After we broke the news about this attack, Microsoft security researcher Phillip Misner confirmed that the DearCry, or what they call DoejoCrypt, is installed in human-operated attacks using the new Microsoft Exchange exploits.
Microsoft observed a new family of human operated ransomware attack customers - detected as Ransom:Win32/DoejoCrypt.
A. Human operated ransomware attacks are utilizing the Microsoft Exchange vulnerabilities to exploit customers.
News URL
Related news
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- Microsoft fixes bug causing Windows Server 2025 boot errors (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)
- Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware (source)
- US seizes domain of Garantex crypto exchange used by ransomware gangs (source)
- International cops seize ransomware crooks' favorite Russian crypto exchange (source)
- Like whitebox servers, rent-a-crew crime 'affiliates' have commoditized ransomware (source)
- Microsoft: North Korean hackers join Qilin ransomware gang (source)
- Microsoft Exchange Online outage affects Outlook web users (source)
- Microsoft: Exchange Online bug mistakenly quarantines user emails (source)