Ryuk Ransomware: Now with Worming Self-Propagation
The Ryuk scourge has a new trick in its arsenal: Self-replication via SMB shares and port scanning. A new version of the Ryuk ransomware is capable of worm-like self-propagation within a local network, researchers have found. The variant first emerged in Windows-focused campaigns earlier in 2021, according to the French National Agency for the Security of Information Systems (ANSSI). The agency said that it achieves self-replication by scanning for network shares, and then copying a unique version of the ransomware executable (with the file name rep.exe or lan.exe) to each of them as they’r...
Source: threatpost.com