WannaSmile
- First seen
- 2017-11-17 00:00:00
- Malware type
- ransomware
- Profile updated
- 2026-07-07 13:41:44
Targeted regions: country_code:ir
Context
zCrypt variant discovered on November 17, 2017, one day after the discovery of TYRANT. Used Farsi-language ransom note asking for a staggering 20 Bitcoin ransom payment. Also advertised local Iran-based payment processors and exchanges—www.exchangeing[.]ir, www.payment24[.]ir, www.farhadexchange.net, and www.digiarz.com)—through which Bitcoins could be acquired.
Reports & references
- accenture.com — Accenture Cyber Threatscape Report 2018 (report)
- id-ransomware.blogspot.com — Wannasmile Ransomware (report)