Dangerous Ryuk encrypts a network, rendering systems useless

A new version of Ryuk ransomware is equipped with an additional worm-like capability to spread itself around infected networks, potentially making it even more dangerous than it was before. Ryuk encrypts a network, rendering systems useless and the cyber criminals behind the attack demand a payment in exchange for the decryption key.

Ryuk ransomware spawning subprocesses with “8 LAN” as their argument upon execution. Ryuk leveraged this argument to scan the device’s ARP table . This demand can stretch into millions of dollars.

As per ZDNet, the ransomware can propagate itself across the network using Wake-on-LAN, a feature that enables Windows computers to be turned on remotely by another machine on the same network. By spreading to every reachable machine on the network, the Ryuk attack can be much more damaging.

This capability was discovered while ANSSI was responding to an unidentified Ryuk ransomware incident earlier this year. The ANSSI paper warms that Ryuk remains particularly active and that "at least one of its operators attacked hospitals during a pandemic.