The National Computer Virus Emergency Response Center (CVERC) has identified multiple incidents involving the Weaxor ransomware targeting users in China. The malware encrypts files and appends extensions such as .weax, .rox, .wxx, .wxr, .weaxor, .roxaew, or .wax to the original filenames.
Attackers leave ransom notes on compromised systems demanding payment. The virus supports both Windows and Linux platforms, targeting enterprise databases, office automation systems, and other business infrastructure. It lacks self-propagation capabilities and is typically deployed manually or automatically after an initial breach.
Cybercriminals gain access by exploiting weak passwords or system vulnerabilities. Once inside, they use PowerShell scripts and remote control tools to deploy the ransomware. The encryption process involves a multi-layered approach using Elliptic Curve, AES, and ChaCha20 algorithms.
CVERC warns that there is currently no reliable way to recover data encrypted by Weaxor without the decryption key. Furthermore, the center cautions against using unofficial decryption tools found online, as they may contain secondary malware infections.
The agency advises network operators, particularly small and medium-sized enterprises, to conduct regular security audits and ensure that all protective measures are fully implemented to prevent unauthorized access.
