DearCry
Aliases: DoejoCrypt
- First seen
- 2021-03-09 00:00:00
- Malware type
- ransomware
- Profile updated
- 2026-07-07 13:44:15
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical education-and-nonprofits
Context
DearCry, also known as DoejoCrypt, is a ransomware variant observed exploiting vulnerabilities in Microsoft Exchange servers. This ransomware encrypts files on compromised systems and demands a ransom for decryption.
Detection coverage
- 4 YARA rules
Detection rules
- DITEKSHEN_MALWARE_Win_Doejocrypt (yara-rule)
- DITEKSHEN_INDICATOR_KB_ID_Ransomware_Doejocrypt (yara-rule)
- SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 (yara-rule)
- SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 (yara-rule)
Reports & references
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- advanced-intel.com — Adversarial Perspective Advintel Breach Avoidance Through Monitoring Initial Vulnerabilities (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Dearcry (report)
- youtube.com — Watch (report)
- youtube.com — Watch (report)
- news.sophos.com — Dearcry Ransomware Attacks Exploit Exchange Server Vulnerabilities (report)
- lifars.com — Dearcry Ransomware (report)
- youtube.com — Watch (report)
- youtube.com — Watch (report)
- CISA — Ar21 102B (report)