Ryuk ransomware now self-spreads to other Windows LAN devices

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/

A new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims' local networks has been discovered by the French national cyber-security agency while investigating an attack in early 2021.

"Through the use of scheduled tasks, the malware propagates itself - machine to machine - within the Windows domain," ANSSI (short for Agence Nationale de la Sécurité des Systèmes d'Information) said in a report published today.
"Once launched, it will thus spread itself on every reachable machine on which Windows RPC accesses are possible."

To propagate itself over the local network, the new Ryuk variant lists all the IP addresses in the local ARP cache and sends what looks like Wake-on-LAN (WOL) packets to each of the discovered devices. It then mounts all sharing resources found for each device so that it can encrypt the contents.

Ryuk ransomware now self-spreads to other Windows LAN devices

A new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims' local networks has been discovered by the French national cyber-security agency while investigating an attack in early 2021.

www.bleepingcomputer.com