“Yanluowang”, a rising ransomware strain, was recently discovered by the Broadcom Symantec Threat Hunter Team conducting targeted attacks against enterprise organizations. Researchers identified the ransomware strain, as described in their report linked below, by examining a recent ransomware attack against an undisclosed organization and obtaining malicious files that involved a “suspicious” use of AdFind on the network. AdFind is a “legitimate command-line Active Directory query tool” and is commonly abused by threat actors for reconnaissance and lateral movement. After this suspicious use was discovered, the ransomware attack operators attempted to deploy the Yanluowang ransomware, which “stops all hypervisor virtual machines running on the compromised computer”, “ends processes listed in processes.txt” (including SQL and the Veeam backup solution), encrypts files on the machine and adds the “.yanluowang” extension, and leaves a ransom note titled “README.txt” if successful. This ransom note “warns victims not to contact law enforcement or ransomware negotiation firms” and threatens that, if the instruction is not followed, distributed denial-of-service (DDoS) attacks will occur along with “calls to employees and business partners”. The threat actors also threaten to repeat the attack and delete the victim’s data “in a few weeks” if the victim does not contact them within twenty-four (24) hours over email. The Threat Hunter Team emphasized that the Yanluowang ransomware is still in development and provided a small number of indicators of compromise (IOCs) at the conclusion of their report.