Sorry
Sorry ransomware is a ransomware strain observed in active exploitation campaigns against internet-exposed cPanel and WHM infrastructure in 2026. Reporting directly links it to exploitation of the critical cPanel authentication bypass vulnerability CVE-2026-41940 and to exploitation activity involving the LiteSpeed User-End cPanel Plugin privilege-escalation flaw CVE-2026-48172. The campaign is described as vulnerability-driven and focused on shared hosting infrastructure, with rapid post-compromise deployment after access is obtained.
Observed behavior includes encrypting files and appending the ".sorry" extension; specifically noted examples include files such as index.html.sorry, index.php.sorry, and wp-config.php.sorry. Multiple sources state that most vulnerable instances hit in these campaigns were encrypted with the ".sorry" extension, and one report ties the activity to the Sorry/Hidden-Tear family. Censys reported at least two parallel campaigns following cPanel compromise: deployment of a Mirai botnet variant identified as nuclear.x86 and a ransomware campaign associated with Sorry.
The malware has been attributed in the provided content only to unknown or unattributed threat actors. The content states that multiple third parties weaponized CVE-2026-41940 within 24 hours of disclosure, including actors deploying Mirai variants and Sorry ransomware. One report describes the Sorry campaign as operated by an unattributed threat actor and highlights it as evidence of a shift toward large-scale, exploit-led ransomware propagation.
Targeting in the provided reporting centers on cPanel/WHM servers and shared hosting environments. The campaign reportedly affected large numbers of exposed systems: one report states that about 44,000 internet-facing servers were rapidly compromised via CVE-2026-41940, another says roughly 7,000 cPanel servers were affected by the ransomware activity, and Macnica reported that 194 of 1,692 publicly exposed cPanel/WHM servers in Japan were hit with Sorry ransomware. The broader ransomware reporting also notes evidence that Sorry exploited CVE-2026-41940 as a zero-day.
High-confidence indicators and artifacts mentioned in the content are the ransomware name "Sorry" and encrypted files bearing the ".sorry" extension.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Among new threats, instances of Gunra posting “phantom victims” were identified, and evidence was observed of the Sorry ransomware exploiting the cPanel authentication bypass vulnerability CVE-2026-41940.
CISA has added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The flaw is a maximum-severity privilege escalation vulnerability (CVSS v4.0: 10.0) residing in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4... Active exploitation has been observed deploying Mirai botnet variants and a ransomware strain called “Sorry.” | Active exploitation has been observed deploying Mirai botnet variants and a ransomware strain called “Sorry.”
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
The root cause is a logic flaw in the plugin’s lsws.redisAble JSON-API endpoint, which is exposed to every logged-in cPanel user by default... Any authenticated cPanel user can exploit this weakness to gain elevated privileges, ultimately achieving full administrative control over the affected server.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
The root cause is a logic flaw in the plugin’s lsws.redisAble JSON-API endpoint, which is exposed to every logged-in cPanel user by default... Any authenticated cPanel user can exploit this weakness to gain elevated privileges, ultimately achieving full administrative control over the affected server.
Privilege Escalation
2 techniques
Privilege Escalation
The root cause is a logic flaw in the plugin’s lsws.redisAble JSON-API endpoint, which is exposed to every logged-in cPanel user by default. There is no race condition to win, nor an authentication gap to bridge — a single malformed API call with the right parameter values is sufficient to escalate to root. Any authenticated cPanel user can exploit this weakness to gain elevated privileges, ultimately achieving full administrative control over the affected server.
The root cause is a logic flaw in the plugin’s lsws.redisAble JSON-API endpoint, which is exposed to every logged-in cPanel user by default... Any authenticated cPanel user can exploit this weakness to gain elevated privileges, ultimately achieving full administrative control over the affected server.
Stealth
1 technique
Stealth
The root cause is a logic flaw in the plugin’s lsws.redisAble JSON-API endpoint, which is exposed to every logged-in cPanel user by default... Any authenticated cPanel user can exploit this weakness to gain elevated privileges, ultimately achieving full administrative control over the affected server.
Credential Access
1 technique
Credential Access
Discovery
1 technique
Discovery
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware observed exploiting a cPanel authentication bypass vulnerability.
A ransomware strain observed being deployed in attacks exploiting CVE-2026-48172 against vulnerable LiteSpeed User-End cPanel Plugin versions.
A ransomware strain deployed by unknown threat actors through exploitation of a critical cPanel vulnerability.
Lightweight Linux ransomware used in mass exploitation of internet-facing hosting infrastructure, employing ChaCha20 + RSA-2048 and standardized ransom workflows.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.