Sorry Ransomware Decryption & Data Recovery

Sorry is ransomware that broke out in 2026. Written in Go, it targets internet-exposed Linux web servers almost exclusively (whether it counts as a family of its own is disputed - see below), and its scale is tied to one vulnerability: the cPanel / WHM (including DNSOnly) authentication bypass CVE-2026-41940 (CNNVD-202604-5641, CVSS 9.8), exploited as a zero-day from late February 2026 and hit far harder once the patch shipped at the end of April. On 2 May 2026 BleepingComputer reported mass exploitation to deploy the Sorry Linux encryptor, citing Shadowserver figures of at least 44,000 compromised cPanel IP addresses. On 10 August China's National Computer Virus Emergency Response Center (CVERC) issued a national advisory confirming multiple domestic incidents, and on 4 September a cyber-police advisory carried by People's Daily named Sorry and Weax as recently very active, listing manufacturing, trade, healthcare, education and technology victims.

This is an opportunistic, volume-driven operation: internet-wide scanning followed by batch deployment. Small-company websites, web application servers, finance and ERP servers, and cloud instances take the brunt. CVERC notes the payload runs on most mainstream Linux distributions used in China, including domestic (Xinchuang) systems, and spreads on its own - one compromised edge server can become a network-wide event.

Attribution is contested, and this page states both readings. For "a new TellYouThePass variant": AsiaInfo's May 2026 report, titled as a deep analysis of "a new TellYouThePass variant", compared static sample features and behaviour chains and concluded the samples are "a new variant with a strong association to the TellYouThePass family", a position its August report on the Linux wave keeps (detection name Ransom.Linux.YSORR.THEOEBF); a March report by the Solar incident-response team, republished on CN-SEC, likewise calls it "highly homologous" with this family's .locked variant, though without a code-level comparison. For "a separate new family": CVERC's 10 August advisory states plainly that the malware "belongs to Sorry, a ransomware family newly seen in 2026"; BleepingComputer, Censys and ThreatLocker all covered the campaign without linking it to any known family; researcher Rivitna judged it "not HiddenTear, but a new ransomware developed in Go"; and Amigo-A registered it separately on ID-Ransomware as SorryGo (Sorry 2026). Qi'anxin's report simply notes that "some public analyses associate it with TellYouThePass or Phobos, and sources disagree". 360's March advisory offers a third reading again: the tradecraft resembles TellYouThePass while the note format looks closer to WormHole. The practical conclusion: attribution is unsettled, response should not depend on the family label, identification and recovery decisions must come from the sample in hand, and reports to third parties should record both readings.

Separately, a 2018 HiddenTear campaign also appended .sorry and is unrelated to this wave; and as of September 2026 Sorry runs no public leak site - the note carries no payment address, only manual Tox negotiation.

Extension and note. The .sorry suffix is appended to the complete original filename, so order.sql becomes order.sql.sorry. A README.md is written into every encrypted directory carrying a fixed Tox ID and instructing the victim to install qTox. Within a campaign the note is essentially identical for every victim - no per-victim code, no Bitcoin address, no web negotiation portal.

Host-side symptoms, usually noticed before the extension.

• SSH is forcibly stopped (systemctl stop sshd, service ssh stop and two more variants, run through both /bin/bash and /bin/sh to cover different distributions), so the first report is typically "we suddenly cannot SSH into the server".
• Database processes are killed with pkill -9, so the application breaks before anyone notices the files.
• The malicious process masquerades under a common sshd process name.
• Executables named .sorry_ plus eight random characters appear under /tmp, alongside a matching .log file.
• Outbound Tor connections to an .onion address are present.

File structure. Encrypted files carry a fixed-length header holding a magic value, a truncated fragment of the original filename and the RSA-wrapped key block, so they are slightly larger than the originals. The header length varies by build: the August variant reversed by Topsec uses 288 bytes (0x120), while another public analysis of the May cPanel campaign records a roughly 2KB header - so the actual sample decides.

Telling this wave apart from the older TellYouThePass .locked campaigns. Some vendors file this activity as a new TellYouThePass variant, yet the observable differences are substantial. The .locked campaigns ship both Windows and Linux builds, drop README.html or READ_ME.html rendered as a web page, embed a Bitcoin address with a small demand around 0.1 BTC, take contact through self-hosted domain mailboxes or a Tor page, and get in through application-layer flaws in products such as Yonyou NC, Chanjet T+, Log4j2 or PHP CGI. This .sorry wave is a 64-bit Linux ELF written in Go and obfuscated with Garble, drops a plain-text README.md (AsiaInfo records the name as ReadMe.md), carries no payment address and only a fixed Tox ID, and enters through cPanel/WHM CVE-2026-41940 followed by weak-password SSH movement inside the network. Note also that a separate March 2026 wave in China - fileless HTA/VBScript delivery on Windows with shadow-copy deletion, per the Solar and 360 reports - also appended .sorry and is not the same payload as the Linux cPanel wave. Seeing ".sorry" therefore does not by itself make this page's response applicable; establish which payload you are holding first.

Bottom line. The .sorry extension plus a same-directory README.md plus a Tox ID plus a 64-bit Linux ELF payload identifies the wave described on this page. Be aware that several Chinese data-recovery blog posts describe .sorry as "RDP brute force on Windows with sparse encryption", which contradicts every authoritative sample analysis: all publicly confirmed samples are 64-bit Linux ELF binaries and the encryption is not intermittent. Attribution must come from the actual sample, because it decides whether structural repair is on the table at all.

Initial access. Operators abuse the WebPros cPanel / WHM authorisation bypass CVE-2026-41940 to obtain server administration rights, then drop and run the encryptor with no victim interaction. No phishing and no weak password are needed - only an unpatched control panel facing the internet, which is why it spreads far faster than hands-on-keyboard ransomware.

Environment profiling. The sample builds a unique victim identifier (username, hostname, CPU count, operating system details, active network interfaces) and reports it back over a Tor hidden service.

Clearing the way. Before encryption it stops the SSH service to cut the administrator's remote rescue channel and force-kills database, security and backup services - freeing file handles and sharply narrowing the response window.

Data theft. CVERC lists exfiltration as a distinct stage: business data, configuration files and internal documents are stolen in bulk before encryption. No public leak site has been observed, so what happens to that data afterwards is opaque - "it has not been posted" is not evidence the data is safe.

Lateral movement, the part most often underestimated. Internal SSH services are scanned and brute-forced concurrently with a built-in weak-password dictionary (public analyses do not enumerate the ports, so cover both the standard port and custom ones) (entries such as user@123, 1234 and 2024-2026). On success the payload is uploaded over SFTP into the remote /tmp directory, marked executable and started with nohup, and each newly compromised host repeats the full chain. Response must therefore never stop at the server that was exploited: wherever internal Linux hosts share credentials or use weak ones, the infection walks across them over SSH.

Engineering quality. The samples are 64-bit Linux ELF binaries written in Go and obfuscated with Garble, with over 99% of symbols destroyed.

Hybrid key scheme. A random symmetric key from Go's crypto/rand is wrapped with an embedded RSA-2048 public key under PKCS#1 v1.5 and written into the file header; the plaintext key exists only briefly in memory. Both the symmetric cipher and the key granularity differ between reported samples: BleepingComputer and researcher Rivitna describe ChaCha20 in the May cPanel campaign builds with a per-victim master key and per-file nonces; the variant Topsec's Alpha Lab captured in August used AES-256-GCM over 64KB chunks with a separate key per file; CVERC's advisory simply says AES. Several build branches most likely exist, but all sources agree on the RSA-2048 outer wrap.

Not intermittent encryption - and this drives recovery strategy. Directories are walked concurrently and any file matching the built-in extension whitelist (84 entries in the variant Topsec reversed) is encrypted in full, streamed rather than partially, with GCM providing block-level integrity checks. That is fundamentally different from partial-encryption families such as Rhysida or LockBit: the ciphertext leaves no intact regions for page-level database extraction, so "repair what intermittent encryption missed" is not available here.

Deliberate destruction of recovery paths. After encryption the sample reopens the original with O_WRONLY and overwrites it with crypto/rand data - 1MB for files under 10MB, 5MB for files of 10MB or more - then forces the write to disk. This is an explicit anti-forensics design.

Platform coverage. Linux has no volume shadow copies to delete, so the same effect is achieved by stopping services and killing processes. Only Linux encryptors have been publicly confirmed; no Windows or ESXi build has been verified by authoritative analysis, although Go's cross-platform nature means other builds cannot be ruled out.