Wmansvcs Ransomware Decryption & Data Recovery

Wmansvcs surfaced in June 2025 and is tracked by Qihoo 360 as Win32/Ransom.Wmansvcs; in China it is usually called "the .wman ransomware" after its extension. By 360's account its infection volume sat in the domestic top two for a sustained period after it appeared - one of the highest-volume families handled by Chinese responders across 2025 and 2026.

Written in Rust and circulating almost exclusively inside China, it targets Windows servers at small and mid-sized enterprises and public-sector bodies: ERP and MES hosts, finance and database servers, domain controllers. Entry is predominantly RDP brute force, with the encryptor deployed by hand once a server is held. The Solar incident response team files Wman and .peng under the Rast Gang family it tracks; Qi An Xin's threat intelligence centre has published separately on the Rast operators but does not name Wmansvcs, so the precise lineage rests on a single source for now.

On 16 April 2026 360 published that it had broken the encryption implementation and would decrypt for victims free of charge; on 10 September 2026 Solar released a downloadable recovery tool for .wman / .peng. Once cracked, the crew dropped the Wmansvcs brand for BrzCrypt (first .brz, then .flex). 360's July 2026 trend report ties the two together through identical attack infrastructure and link fingerprints and states plainly that the break is why the operators switched; Wmansvcs is absent from that month's rankings, with BrzCrypt in its place. Wmansvcs should therefore be read as retired-under-a-new-name: fresh incidents present as BrzCrypt, while historic .wman / .peng data has entered a window in which decryption is genuinely possible.

Extensions. Two branches, .peng and .wman. Some builds write a 13-character device ID and the operator's mailbox straight into the filename - report.xlsx.[[deviceID]].[[account@domain]].wman.

Ransom note. DECRYPTION_INFORMATION.html appears in affected directories, carrying a victim ID and an email address with no onion portal. The desktop wallpaper is replaced with a ransom message at the same time.

Other indicators.

• A fixed-length marker string sits at the tail of the encrypted data and helps separate branch and build.
• Port 3389 is exposed at the perimeter, often alongside database ports such as 3306 and 1433, and logon records show the classic brute-force shape: a long run of failures followed by a sudden success.
• Credential-dumping tooling (browser password viewers, Mimikatz-class utilities) plus internal scanners and remote brute-forcers turn up on staged hosts, matching the toolset documented for the same crew at the BrzCrypt stage.
• The usual companions of hands-on deployment - new administrator accounts, security software uninstalled or force-terminated, shadow copies and logs cleared - should each be checked for on site, though the exact form varies by incident.

Bottom line. A .wman / .peng extension plus DECRYPTION_INFORMATION.html is enough to attribute the family, but whether decryption applies depends on how keys were used in that deployment, so real encrypted files must be analysed. Separate it from the successor BrzCrypt (.brz / .flex, an information.html note and a DATACORE marker at the ciphertext tail) - the recovery paths differ completely.

• RDP brute force. The dominant vector. Servers exposing 3389 at the perimeter fall first, and environments that also publish database ports such as 3306 and 1433 carry more risk still.
• Hands-on deployment. The operator runs the encryptor manually after taking a server. This is sustained, targeted intrusion rather than worm-like spread, which means the attacker has usually been inside for days before files lock.
• Credential theft and lateral movement. Browser password viewers and Mimikatz-class tools harvest credentials; internal scanning then extends reach. One May 2026 incident published by Solar covered 15 servers, so a single event rarely stops at one host.
• Backdoor accounts and defence weakening. A new administrator account maintains access while security software processes and services are uninstalled or force-terminated - a routine part of this crew's hands-on playbook, to be confirmed item by item on site.
• Victim profile. Mostly Windows servers at small and mid-sized enterprises and public-sector bodies; environments with no server-side endpoint protection and no MFA on remote access are the ones that fall hardest.

Algorithms. Rust-built, encrypting content with the ChaCha20 stream cipher family and wrapping keys with RSA (Solar's reverse engineering records an RSA-2048 + ChaCha20-Poly1305 hybrid).

The implementation flaw. The encryptor generates a 32-byte key and an 8-byte nonce once, before entering the file loop, then reuses that one keystream for every file in the deployment - the root cause of the break. Solar puts it plainly: the first 512KB of every file is XORed with the same keystream. That makes a known-plaintext attack work: one matched pair from a file over 512KB recovers the keystream and unlocks the rest of that batch. Keys differ across batches and builds, so material from one incident does not transfer.

Encrypted regions, by branch - this is what decides how much repair space is left. 360's analysis reports that files up to 512KB are encrypted in full; on the .wman branch, files over 512KB have only their first 512KB encrypted and the remainder stays plaintext; the .peng branch uses sparse encryption across three head/middle/tail blocks, with a measured 2.67MB file having roughly 192KB encrypted - about 7.2%. Coverage should still be measured on representative large files from the actual environment.

Recovery inhibition. Hands-on deployment typically comes with targeted processes and services stopped, volume shadow copies deleted and system logs cleared. Because database and backup agents are stopped first, production data and its backups frequently fail together.

Platforms and extortion model. Only Windows encryptors have been reported (360 classifies the family as Win32/Win64); no Linux or ESXi build has surfaced and no leak site for this family appears in public reporting, so pressure comes from encryption rather than publication. Systematic exfiltration is documented mainly from the successor brand BrzCrypt onward.