Chicago-based Tribune newspapers’ print runs were disrupted or delayed by a malware outbreak. The outbreak involved crypto-locking Ryuk ransomware, which appeared to have been contained before it then managed to continue spreading. The appearance of Ryuk led some media outlets to rush to connect the attribution dots and suggest that North Korea had attempted to disrupt U.S. newspapers. The attacks by the group behind Ryuk, which calls itself Grim Spider, netting it more than 100 bitcoins (over $380,000) this month alone.”]
Source: https://www.govinfosecurity.com/blogs/stop-presses-dont-rush-tribune-ransomware-attribution-p-2700