{
  "family": "cwqw",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Cwqw (identified across antimalware research as Ransom:Win32/Cwqw, Trojan-Ransom.Win32.Cwqw, and Ransom.Cwqw) is an evasive corporate crypto-ransomware family designed to execute destructive file encryption while actively impairing endpoint defenses. Distributed primarily via malicious loader networks and exploited network perimeter devices, Cwqw executes aggressive pre-encryption routines. Prior to encrypting data, the malware terminates an extensive list of targeted Windows services and processes, specifically targeting database servers (Microsoft SQL Server, MySQL, Oracle), mail servers (Exchange), hypervisors, and enterprise backup software (Veeam, Acronis). By forcibly terminating these processes, Cwqw unlocks restricted database handles and prevents automated backup systems from interfering with the encryption process. Cwqw then deploys high-speed symmetric stream encryption across all accessible drives, encrypting documents, databases, and code repositories, before deleting shadow copies and leaving extortion instructions demanding cryptocurrency ransom payment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Cwqw",
    "Trojan-Ransom.Win32.Cwqw",
    "Win32/Cwqw",
    "Cwqw Ransomware",
    "Ransom.Cwqw"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Cwqw?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cwqw is a ransomware family that terminates database and backup processes to encrypt enterprise files without handle conflicts."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Cwqw terminate enterprise services before encrypting?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminating services releases active file locks on mission-critical databases and virtual hard drives, allowing them to be encrypted."
      }
    },
    {
      "@type": "Question",
      "name": "Which services does Cwqw commonly target for termination?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets Microsoft SQL Server, MySQL, Oracle, Microsoft Exchange, Veeam Backup, and security monitoring agents."
      }
    },
    {
      "@type": "Question",
      "name": "Does Cwqw encrypt files on network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. It enumerates mapped network shares and accessible Server Message Block (SMB) servers across the local subnet."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Cwqw infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Implement endpoint privilege restrictions, deploy tamper-protected EDR agents, enforce multi-factor authentication on RDP, and keep immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1057",
    "T1083",
    "T1135"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Cwqw from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Cwqw persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Cwqw attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Cwqw modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Cwqw dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Cwqw",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Cwqw"
    },
    {
      "name": "Trend Micro Security Research - Ransom.Win32.CWQW Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.cwqw"
    },
    {
      "name": "MITRE ATT&CK - Impair Defenses: Disable or Modify Tools (T1562.001)",
      "url": "https://attack.mitre.org/techniques/T1562/001/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}