A new version of the Ryuk ransomware is capable of self-propagation within a local network. The French National Agency for the Security of Information Systems (ANSSI) says it achieves self-replication via SMB shares and port scanning. The malware also interrupts multiple programs based on hardcoded lists, including a list of 41 processes to be killed (task kill) and 64 services to stop. An effective defense should involve developing countermeasures that will prevent that initial foothold, ANSSI says.
Source: https://threatpost.com/ryuk-ransomware-worming-self-propagation/164412/