A new variant of the Ryuk Ransomware has been discovered that adds IP address and computer blacklisting so that matching computers will not be encrypted. This new Ryuk variant would check the output of arp -a for particular IP address strings. If the computer name contains any of these strings, Ryuk will not encrypt the computer. There is the speculation that the string MSK may stand for Moscow and SPB could mean St. Petersburg.”]
Source: https://hackercombat.com/ryuk-ransomware-variant-blacklists-ip-addresses-computers/