--- title: DearCry ransomware exploits Exchange server vulnerability description: DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021. canonical_url: https://www.acronis.com/en/tru/posts/dearcry-ransomware-exploits-exchange-server-vulnerability/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 27 April 2021 # DearCry ransomware exploits Exchange server vulnerability DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary * Encrypts files using AES-256 and RSA-2048 ciphers, which makes decryption impossible without paying a ransom * Adds ‘.CRYPTO’ extension * Replaces the content of the original files with “A” * Also known as “Ransom:Win32/DoejoCrypt.A” according to the Microsoft’s malware naming convention * Targeting organizations in the United States, Luxembourg, Indonesia, Ireland, India and Germany ## Attack vectors The attackers use the recently disclosed zero-day ProxyLogon vulnerabilities to hack into [Microsoft Exchange servers](https://www.acronis.com/en/blog/posts/backup-microsoft-exchange/). The first DearCry attack was discovered on March 9, 2021. ## Static analysis The file under analysis is 1322521 bytes in size (SHA256: fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65), and at the time of writing was detected by 45 antiviruses out of 68 mentioned on [VirusTotal](https://www.virustotal.com/gui/file/fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65/detection). This sample was first submitted to VirusTotal on March 12, 2021: ![Image 1: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/1ab4724925308d143be3f7c8a0e6dc90.png) The original file name is ‘_encryptfile.exe_’ according to static analysis of the executable file. This can be guessed from the debug information available in the binary: _c:\users\john\documents\visual studio 2008\projects\encryptfile -svcv2\release\encryptfile.exe.pdb_ ## Installation Once executed, the malware registers a service named ‘_msupdate_.’ ![Image 2: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/5a542d20c906c3ff4f53ec83b984e01e.png) It begins file encryption using this service. ![Image 3: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/b55686ff83ee549501f26187f6d37c1c.png) After file encryption is completed, DearCry stops and deletes the service. ![Image 4: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/93972cac2aaf2b5962edeae2497c67e4.png) ## File encryption To encrypt files, DearCry uses the AES-256 cipher, the keys for which are encrypted afterwards with the following master public RSA-2048 key: ![Image 5: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/f7482691b399373b4915795f05a69751.png) ![Image 6: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/66093f619b6326cf820665041e78d81c.png) The ransomware calculates the MD5 hash of the public key: ![Image 7: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/958e3472e441dc91093d47ee4d1dd8a6.png) It then inserts this hash into a ransom note: ![Image 8: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/4ea9448236e83c711fc76604dfdad021.png) ![Image 9: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/b636af35363693d5164ccf55c0ffe5ba.png) DearCry locates all logical drives from ‘C:’ to ‘Z:.’ If the disk is not a CDROM drive, it creates a text file in the root directory named ‘readme.txt’ and saves the ransom note there. ![Image 10: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/ca49136005ca2dea2fc356fe0dc6159c.png) DearCry searches for files on the disk with a filename less than 1300 characters. It encrypts all such files with the following extensions: **.TIF****.TIFF****.PDF****.XLS****.XLSX****.XLTM****.PS****.PPS****.PPT****.PPTX****.DOC****.DOCX****.LOG****.MSG****.RTF****.TEX****.TXT****.CAD****.WPS****.EML****.DBF****.INI****.CSS****.HTM****.HTML****.XHTML****.JS****.JSP****.PHP****.KEYCHAIN****.PEM****.SQL****.APK****.APP****.BAT****.CGI****.ASPX****.CER****.CFM****.C****.CPP****.STM****.GO****.CONFIG****.CSV****.DAT****.ISO****.PST****.PGD****.7Z****.RAR****.ZIP****.ZIPX****.TAR****.PDB****.BIN****.DB****.MDB****.MDF****.BAK****.LOG****.EDB****.ORA** DearCry does not encrypt files in the following folders: %WinDir% %AppData% %ProgramFiles(x86)% %Temp% The ransomware adds the header “DEARCRY!” to the encrypted files and also adds the extension “.CRYPT.” ![Image 11: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/3a6c1ec473dd70af9a6d849cf4c0f498.png) The structure of the encrypted file is as follows: ![Image 12: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/71fc7255c36293a510adc3d962c302c8.png) To complicate the recovery, the ransomware overwrites the data in the original file with the character ‘A’: ![Image 13: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/697333f2201b7ba7fa79ddfba3c18d37.png) ![Image 14: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/a4e058fd97ab6dc9a1d316ec0e419e78.png) ## Detection by Acronis Acronis Cyber Protect not only detects and blocks DearCry ransomware, but can also automatically restore affected files in a matter of seconds. ![Image 15: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/9563afdbd8b1ea7b6ae11b836de68ed3.png) ![Image 16: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/9fc998e90a3c228bc61d466d68875546.png) ![Image 17: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/fab55677573b6eb6b9e52623f076eabe.png) ![Image 18: DearCry ransomware exploits Exchange server vulnerability](https://staticfiles.acronis.com/images/content/a65b3adfc2b1555e33c7055b854f3e45.png) ## Conclusion Attacks with controlled execution, in which the attackers exploit zero-day vulnerabilities discovered in popular services, are especially dangerous. The file encryption scheme employed by DearCry — which includes both symmetric and asymmetric encryption — leaves no chance of file decryption without the right key. In addition, overwriting the content of the original files complicates recovery. Hash: 0e55ead3b8fd305d9a54f78c7b56741a Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)