LCRYX Ransomware WMI Subnet Propagation and USB Worm Activity

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.