Sorry Ransomware Continues to Evolve: From .sorry to .ths Variants—How to Scientifically Rescue Data on Linux Servers and Windows Business Environment

Recently, ransomware attacks targeting enterprise servers in China have shown a clear cross-platform evolution trend. After the National Computer Virus Emergency Response Center (CVERC) and the National Engineering Laboratory for Computer Virus Prevention and Control Technology issued a nationwide security warning about "Sorry ransomware," security monitoring shows that this family has not remained in a single attack form—it not only targets Linux web servers exposed to the public internet (including domestic innovative operating systems) but has also recently derived a new variant in Windows business environments that appends the .ths extension, causing damage to many enterprises' ERP accounts, SQL Server databases, and backup files.

When enterprise operations or finance personnel discover business system interruptions and files being batch-appended with .sorry or .ths extensions, the worst thing to do is to blindly restart, reinstall, or attempt to modify extensions without understanding the variant. Understanding the two attack lines of the Sorry family is the prerequisite for protecting core data and restoring business.

1. Same Origin but Cross-Platform Divergence: The Two Faces of Sorry Ransomware

In actual incident response and sample analysis, many victim enterprises tend to conflate all attacks with .sorry or similar extensions. In fact, the recently active Sorry ransomware exhibits distinctly different technical characteristics and damage focus in Linux and Windows scenarios.

1. Linux Server Defense Line: Masquerading as sshd Process and Double Extortion

According to the CVERC alert, the Sorry ransomware targeting Linux environments is written in Go and can run directly on mainstream domestic Linux distributions and innovative operating systems. Its attack chain has distinct automation and stealth characteristics:

• Vulnerability breach and process masquerading: Attackers often exploit the WebPros cPanel authorization vulnerability (CVE-2026-41940 / CNNVD-202604-5641) to gain server administrative privileges, deploy the virus without the administrator's knowledge, and masquerade it as the common system sshd process.
• Steal first, encrypt later: The virus generates a unique victim identifier containing username, hostname, CPU count, and active network interfaces and sends it back to the attacker, then actively terminates database, security protection, and backup services. After batch-stealing business data and configuration files, it uses AES+RSA algorithms to lock files and append the .sorry extension.
• SSH lateral movement: After a single point of compromise, the program actively scans internal network SSH ports such as 22, 2222, and 22222, using weak passwords to spread laterally to other Linux hosts.

2. Windows Business Environment: Upgrading from .sorry to .ths New Variant

In addition to Linux nodes, in recent attacks against Windows servers and office terminals, the Sorry family has undergone significant version iteration. Some attack samples spread through enterprise remote control software vulnerabilities or internal network shares, completely changing encryption characteristics:

• Extension and ransom note changes: The encrypted file extension changes from .sorry to .ths, and a ransom note named hello.txt is written in infected directories (some early versions used README.md or required downloading specific encrypted communication tools for contact).
• Forced termination of databases and encryption algorithm adjustments: The new variant commonly involves specific loaders (such as dbg.exe) in analysis, forcibly stopping some database and business processes to release file locks during execution, and switching to high-strength encryption schemes such as X25519 and XChaCha20-Poly1305, causing SQL Server databases to be encrypted or ERP systems like UFIDA, Kingdee, and Guanjiapo to instantly paralyze.

2. Why Can't You "Just Look at the Extension and Act"? Three High-Risk Pitfalls to Avoid

Faced with screens full of locked files, the operations of enterprise IT and managers in the first few hours directly determine the success of subsequent data recovery. As we repeatedly emphasized in "How to Investigate When Files Are Appended with Unfamiliar Ransomware Extensions: Don't Just Look at the Last Few Letters, Follow These Three Steps to Identify the Family and Rescue Plan," when encountering Sorry and its variants, especially avoid the following three pitfalls:

1. Confusing similar extensions and applying wrong tools: For example, conflating the .ths of the new Sorry variant with the .thx variant of the Dharma family, or mistakenly treating the old TellYouThePass gang/new Sorry family as equivalent to same-named extension samples under the early Stop/Djvu family. Different families have completely different underlying encryption logic and header coverage ratios. Blindly using third-party tools to attempt decryption can easily cause secondary damage to the original ciphertext.
2. Mistaking "antivirus completion = crisis resolved": Security software only kills resident malicious programs (such as masqueraded processes or loaders). Encrypted databases and documents will not automatically restore just because antivirus succeeded. More dangerously, directly reinstalling the system or formatting the disk will completely overwrite data fragments originally remaining at the disk底层, temporary table spaces, or unallocated clusters.
3. Directly mounting backups or restarting online without verification: The Sorry family explicitly includes actions to "terminate backup services" and "pollute mapped shared drives." If you rush to mount backup drives for recovery without first investigating sshd masqueraded processes, weak SSH passwords, or remote control software backdoors, you can easily trigger secondary infection as described in "Why Does Ransomware Data Recovery Get Encrypted Again."

Therefore, the first step upon discovery is always physical network isolation, blocking ports 22/2222/22222 and internal SMB share connections, then using ransomware identification tools or referring to the ransomware extension lookup table, combined with the original ransom note and sample files, to complete precise identification.

3. How Can Enterprises Scientifically Rescue Core Data After a Sorry Ransomware Attack?

The CVERC alert has clearly stated that without decryption keys, data directly encrypted by Sorry ransomware's high-strength algorithms currently has no publicly available universal free decryption tool. However, this does not mean enterprises can only stall or passively compromise. For enterprises with damaged servers, databases, and virtualization platforms, Shemo Wule follows the principle of not paying ransom, not negotiating on behalf; first identify the family, assess recoverable scope, then provide solutions and quotes, advancing rescue through the following four steps:

1. Sample Identification and Recoverability Assessment

While protecting the original disk and memory scene, first extract ransom notes (such as hello.txt) and representative encrypted samples for in-depth analysis to determine whether the current encounter is the Go language version under Linux or the .ths variant under Windows. Based on the damaged file structure, issue clear ransomware decryption and recoverability assessment conclusions (covering recoverable scope, optional paths, expected results, and risks). Provide the assessment conclusions to the enterprise first, and then let the enterprise decide whether to proceed (see Service Process and Quotation Description).

2. Multi-Path Data Rescue for Databases, Virtualization, and Backups

When direct cryptographic decryption is not feasible, core business often requires data recovery through underlying technical means:

• Database file-level repair: For structured databases such as SQL Server (MDF/NDF), MySQL, and Oracle, ransomware programs sometimes only encrypt file headers or sample-encrypt at fixed intervals to pursue encryption speed. Engineers can rescue account sets and business table data through underlying page parsing, fragment extraction, and recombination of unencrypted remnants, delivering with completeness annotations by system and time point (refer to "How to Recover SQL Server Databases Encrypted by Ransomware").
• Underlying salvage of backups and virtualization: If local backups or virtualized storage are also damaged, immediately freeze the current storage state (see "Backup Files Also Encrypted by Ransomware: Freeze Storage First, Then Determine What Can Still Be Saved"). For scenarios such as backups deleted or corrupted and ESXi / Hyper-V virtual machines encrypted, extract usable data from snapshot remnants, volume shadow copies, or virtual disk底层 images.

3. Attack Traceability and Forensics: Addressing the "Data Theft" Double Threat

Because Sorry ransomware has the double extortion characteristic of "first batch-stealing business data and configuration files, then encrypting," simply getting business running again is not enough. Enterprises often need to clarify: Did attackers break in through cPanel vulnerabilities, remote control software, or weak passwords? Was core data actually packaged and exfiltrated? Through professional attack traceability and forensics services, the complete intrusion timeline can be reconstructed based on system logs, disk images, and memory evidence, objectively determining the scope of data leakage, and issuing forensic reports usable for police reporting and regulatory compliance.

4. Emergency Cleanup and Security Hardening: Completely Cutting Off Recurrence Chains

Before restoring data for relaunch, it is essential to combine security emergency response to thoroughly remove resident backdoors, scheduled tasks, and abnormal accounts masqueraded as sshd or system services. Then implement security hardening protection: promptly patch cPanel (CVE-2026-41940) and high-risk vulnerabilities in remote control software; shrink SSH, RDP, and database management ports exposed to the public internet; comprehensively investigate weak passwords and reused passwords across internal networks; and rebuild cross-segment, tamper-proof offline backup systems.

Need Emergency Response and Data Rescue?

If your Linux server, Windows database, or ERP system is currently under attack by .sorry, .ths, or other unknown ransomware, immediately disconnect the infected device from the network. Do not format, reinstall, or run unknown decryptors on your own. You can obtain 7×24 professional support from the Shemo Wule team through the following channels:

• Online consultation: Contact Shemo Wule Emergency Team
• 24-hour emergency hotline: 15639272850
• Emergency support email: help@noransom.net