LCRYX Ransomware WMI Lateral Movement and Removable Media Infection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•3

Detects behavior patterns associated with the LCRYX ransomware, specifically lateral movement via WMI (wmic.exe), network subnet scanning, file copy operations to remote SMB shares, and the dropping or execution of VBScript artifacts on removable or non-system drives.