LCRYX Ransomware USB Worm: autorun.inf Drop and wscript.exe Execution from Removable Drive

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•10

Detects LCRYX ransomware behavior involving the creation of autorun.inf files on removable drives combined with the execution of VBScripts from removable media using wscript.exe, indicative of a worm propagating via USB devices.