Recently, the National Computer Virus Emergency Response Center has discovered multiple incidents in which Chinese users have been targeted by the "Weaxor" ransomware. Important files of the users have been encrypted, with file name extensions changed to strings such as ".weax", while the attackers have left ransom notes demanding payment. The "Weaxor" ransomware comes in multiple versions, capable of delivering corresponding programs based on the target operating system type, covering most Windows and Linux platforms, and posing a significant threat to both individual and organizational users. This virus primarily targets enterprise databases, OA office systems, and other business systems, infiltrating servers by exploiting weak passwords or system/software vulnerabilities, and then deploying ransomware to encrypt files through methods such as Powershell scripts and remote control tools.