China's CVERC warns Weaxor ransomware keeps hitting corporate databases and OA systems

CVERC warned of multiple Weaxor ransomware attacks in China, with files renamed with ".weax" and similar extensions; the family remains active in China and globally, mainly targeting corporate databases, OA systems and other business systems ^[1]. Criminals mainly break into servers via weak passwords or system and software flaws before deploying the ransomware, which has Windows and Linux versions; the Windows version also steals local and domain credentials for lateral movement ^[1]. CVERC advises restricting internet access to management interfaces, enabling two-factor authentication and IP limits for VPN and remote desktop, isolating ERP and finance servers, and enforcing strong passwords ^[1].

Industries mainly affected: Cross-industry

1. Restrict internet access to management interfaces; enable 2FA and IP limits on VPN and remote desktop ^[1].
2. Isolate ERP, finance and other key servers from office devices and open only needed ports .