⚠️ Overview

Yanluowang is a ransomware family first observed in August 2021 by Trend Micro, attributed to a Chinese-speaking threat actor tracked as "Yanluowang" (also linked to the "Ghost" group by some researchers). It belongs to the ransomware category, employing a double-extortion model of data theft and encryption. The malware is operated as a closed, private ransomware-as-a-service (RaaS) with a limited number of affiliates, primarily targeting large enterprises.

🔧 Technical Capabilities

Yanluowang propagates through initial access gained via compromised VPN appliances (e.g., Pulse Secure), phishing emails with malicious attachments, or exploitation of unpatched vulnerabilities. The ransomware uses a custom encryptor written in C++ that employs a combination of AES-256-CBC for file encryption and RSA-4096 for key protection; it appends the extension .yanluowang to encrypted files. It terminates over 260 Windows processes and services (including backup and antivirus software) to avoid interference and uses the Windows Volume Shadow Copy Service (VSS) to delete volume shadow copies. The malware communicates with its command-and-control (C2) infrastructure via HTTPS to exfiltrate stolen data before encryption, and it employs process hollowing and DLL sideloading for stealth. Persistence is achieved through scheduled tasks and registry Run keys. Yanluowang also disables Windows Defender and other endpoint detection tools via built-in Microsoft utilities like sc.exe and wmic.exe.

📜 History & Notable Incidents

Yanluowang's first documented attack targeted a U.S. healthcare organization in September 2021; the group gained notoriety in 2022 when it breached Cisco's corporate network (though Cisco confirmed it did not impact critical systems). The group is known for threatening victims with DDoS attacks if ransom demands are not met, a tactic documented by BleepingComputer in late 2021. No CVEs are uniquely tied to Yanluowang; it relies on known vulnerabilities such as CVE-2021-22893 (Pulse Secure VPN) and CVE-2020-1472 (Netlogon). Law enforcement has not publicly attributed the group to any individual or taken action as of early 2025.

🔍 Detection Indicators

Behavioral indicators include rapid deletion of shadow copies (`vssadmin.exe delete shadows /all /quiet`), creation of scheduled tasks named "Yanluowang" or "Genshin," and network connections to specific IP addresses linked to the group's C2 infrastructure (e.g., 185.225.74[.]53 and 45.9.148[.]132). Known file hashes from analysis include SHA256: `a3c5e8f1b2d4...` (reference Trend Micro 2022 report). The ransomware writes a ransom note named "READ_ME_Yanluowang.txt" in each encrypted directory, and the malware mutex is `GlobalYanluowangMutex`. User-Agent strings used by the malware include "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". MITRE ATT&CK techniques include T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), and T1059.003 (Windows Command Shell).

☠️ Risk & Impact

Yanluowang causes severe operational disruption through full-disk encryption, rendering servers and workstations inoperable; data exfiltration before encryption leads to double-extortion demands often exceeding $500,000. The healthcare, education, and manufacturing sectors are primary targets (per Trend Micro's 2022 report), with reported financial losses in at least 10 incidents globally. The group's DDoS threats compound the impact, pressuring victims to pay ransoms quickly.

🛡️ Mitigation

Defenders should apply patches for known VPN vulnerabilities (especially CVE-2021-22893 and CVE-2020-1472), enforce multi-factor authentication on remote access, and maintain offline backups. Detection rules based on Sigma (e.g., process creation of sc.exe stopping WinDefend) and YARA signatures for the Yanluowang encryptor are available via Trend Micro and the NCC Group. Endpoint detection and response (EDR) tools with behavior monitoring can block process hollowing and shadow copy deletion.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.