Yanluowang

Yanluowang is a human-operated ransomware family active from 2021 through late 2022 and associated with targeted intrusions against organizations in the United States and elsewhere. It is known for encrypting victim systems, stealing data prior to encryption, and using double-extortion to pressure payment by threatening public disclosure of stolen information. Reported victim sectors include banking, telecommunications, engineering, and other corporate environments.

Operations linked to Yanluowang relied on an affiliate-style ecosystem that included initial access brokers who identified and exploited vulnerabilities in corporate networks, then sold or shared that access with ransomware operators. After gaining entry, operators conducted follow-on intrusion activity including lateral movement, deployment of ransomware, and extortion. In some cases, coercive pressure reportedly extended beyond encryption and leak-site threats to harassment such as phone calls and distributed denial-of-service activity against victims.

The group behind Yanluowang has been assessed as attempting to present a false Chinese persona, despite reporting that its operators were likely not Chinese. The ransomware operation was publicly identified in 2021 and later disbanded in late 2022 after compromise of its leak infrastructure and exposure of internal communications. A weakness in its encryption implementation was reported to have enabled development of a free decryption tool for some victims.