yanluowang
First seen July 2, 2022Active6 claimed victims
The claims below are reproduced as posted by yanluowang on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
According to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops services, and creates the README.txt file containing a ransom note. It appends the .yanluowang extension to filenames. Cybercriminals behind Yanluowang are targeting enterprise entities and organizations in the financial sector.Files encrypted by Yanluowang can be decrypted with this tool (it is possible to decrypt all files if the original file is larger than 3GB. If the original file is smaller than 3GB, then only smaller files can be decrypted).
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Hot news straight from Cisco | August 10, 2022 | ransomware_live | — |
| Cincinnati bell didn’t pay the ransom | July 2, 2022 | ransomware_live | — |
| Walmart was encrypted | July 2, 2022 | ransomware_live | — |
| Big data dump from various organizations | July 2, 2022 | ransomware_live | — |
| Greetings to havi.com and tmsw.com | July 2, 2022 | ransomware_live | — |
| Shorr.com leakage | July 2, 2022 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).