Log in Request a demo

Ransomware group profile

DearCry

DearCry is ransomware that CISA said, in a March 12, 2021 update, was being used on compromised on-premises Exchange servers.

In short

DearCry is ransomware that CISA said, in a March 12, 2021 update, was being used on compromised on-premises Exchange servers. The servers had been broken into through the Exchange flaws disclosed in March 2021. The sources opened do not name who operated it.

Profile MapRansomware Group
  1. Entry Routes3ways inExchange flaw CVE-2021-26855 · Follow-on Exchange flaws · DearCry file encryption
  2. Defences8first steps listedPatch Exchange at once · Disconnect vulnerable servers

Overview

DearCry is a ransomware program. CISA, the US cyber defense agency, updated its Exchange alert on March 12, 2021 to say it was being used on compromised on-premises Exchange servers. Exchange is Microsoft’s business email server. CISA’s alert and its later malware analysis report are the main public sources opened for this page.

How it reached victims

The ransomware was run on servers that had already been broken into through a set of Exchange flaws. One of them, CVE-2021-26855, lets an outsider with no login send requests and act as the Exchange server. Three more (CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) allow remote code execution. CISA says that exploitation gives an attacker lasting access to the server, its files and mailboxes, and stored credentials. The flaws affect on-premises Exchange, not Exchange Online or Microsoft 365.

What the malware does

CISA’s malware analysis report (MAR-10330097-1.v1, alert code AR21-102B, April 12, 2021) says DearCry encrypts files on a device and demands ransom in exchange for decryption. The report says files are encrypted with AES, with the keys protected by RSA, and that encrypted files get the .CRYPT extension. It also says the program runs a Windows service named msupdate during execution and removes it after encryption. These details come from the report’s analysis of the samples CISA received.

Who is behind it

The sources opened here do not say who operated DearCry. On July 19, 2021 the US Government attributed the wider Exchange exploitation activity to actors linked to the Ministry of State Security of the People’s Republic of China. That statement is about the Exchange activity as a whole, and CISA does not tie it to DearCry. No link between the two is claimed here.

What CISA advised

Patch quickly, because the attack can be scripted and run at scale. Where a patch cannot be applied at once, restrict outside access to the server as a temporary step. If exploitation is found, assume the network’s identity systems are compromised and follow incident response. CISA published its own analysis report on DearCry on April 12, 2021.

DearCry and Exchange timeline
  1. March 3, 2021Exchange alert issuedCISA publishes its first alert on active exploitation of Exchange Server.
  2. March 12, 2021DearCry addedCISA updates the alert to mention DearCry used on compromised Exchange servers.
  3. April 12, 2021Analysis reportCISA adds a malware analysis report on DearCry.
  4. July 19, 2021AttributionThe US Government attributes the Exchange activity to actors tied to China’s Ministry of State Security.
  5. November 3, 2021Known exploitedCVE-2021-26855 is added to CISA’s known exploited vulnerabilities list.

At a glance
Type
Ransomware
Seen
March 2021, per CISA
Main route
Compromised on-premises Exchange servers
Key flaw
CVE-2021-26855
Report
CISA analysis report, April 12, 2021

How they get in

  1. 01

    Exchange flaw CVE-2021-26855

    CISA says this flaw lets an unauthenticated attacker send requests and authenticate as the Exchange server through the Exchange Control Panel.

  2. 02

    Follow-on Exchange flaws

    CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 allow remote code execution once an attacker is in, as described by CISA.

  3. 03

    DearCry file encryption

    CISA's analysis report says the malware encrypts files with AES, protects the keys with RSA, and gives encrypted files the .CRYPT extension. It also says a service named msupdate runs during execution and is removed afterwards.

How to defend

  1. Patch Exchange at once

    CISA says to apply Microsoft's patches as soon as possible, because the attack is scriptable.

  2. Limit outside access if you cannot patch

    Restrict untrusted connections to port 443 or use a VPN, and block outside access to the web mail and admin pages. CISA calls this temporary.

  3. Disconnect vulnerable servers

    CISA advises taking unpatched Exchange servers off the internet until patched.

  4. Scan logs for signs of compromise

    Run Microsoft's log-scanning script and look back to at least January 1, 2021.

  5. Assume identity compromise if found

    If exploitation is found, treat the network's identity systems as compromised and follow incident response.

  6. Report ransomware

    Victims should report it to CISA, the local FBI field office or Secret Service field office.

  7. Use CISA's named Exchange tools

    CISA's alert points to Microsoft's Test-ProxyLogon.ps1 script for scanning log files and the Exchange On-premises Mitigation Tool (EOMT.ps1) to automate detection and mitigation.

  8. Apply general ransomware hygiene

    The analysis report lists current antivirus signatures and OS patches, disabling unneeded file and printer sharing, not adding users to the local administrators group unless required, and enabling personal firewalls.

Questions

What is DearCry ransomware?

DearCry is ransomware that CISA said, in a March 12, 2021 update, was being used on compromised on-premises Exchange servers. CISA's later malware analysis report adds how it encrypts files.

How did DearCry reach its victims?

It was run on servers already broken into through the Exchange flaws disclosed in March 2021. CVE-2021-26855 lets an outsider with no login act as the Exchange server, and three more flaws allow remote code execution.

Who operated DearCry?

The sources opened for this page do not say who operated DearCry. The US Government attributed the wider Exchange activity to actors linked to China's Ministry of State Security, but CISA does not tie that to DearCry.

How do I defend against DearCry?

CISA advised patching Exchange quickly, restricting outside access to the server where a patch cannot be applied at once, and, if exploitation is found, assuming identity systems are compromised and following incident response.

Does DearCry affect Exchange Online or Microsoft 365?

No. The flaws behind the DearCry attacks affect on-premises Exchange, not Exchange Online or Microsoft 365. The ransomware was run on on-premises Exchange servers that had already been compromised through those flaws.

What file extension does DearCry add?

CISA's malware analysis report says encrypted files receive the .CRYPT extension, and that the program uses AES for files with RSA protecting the keys.

Which tools did CISA point Exchange admins to?

The Test-ProxyLogon.ps1 script for scanning log files and the Exchange On-premises Mitigation Tool (EOMT.ps1), both from Microsoft, as listed in CISA alert AA21-062A.

In our research

  1. The Most Affected Products by Vulnerabilities October 2022

Sources

  1. Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities CISA
  2. CVE-2021-26855 record NIST National Vulnerability Database
  3. Malware Analysis Report MAR-10330097-1.v1: DearCry Ransomware (AR21-102B) CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Remote code execution (RCE)

Remote code execution (RCE) is when an attacker runs code of their choice on another person's system from a distance.

Read more