CrowdStrike Intelligence analyzed variants of Ryuk (a ransomware family distributed by WIZARD SPIDER) with new functionality for identifying and encrypting files on hosts in a local area network (LAN) These features target systems that have recently been placed in a standby power state, as well as online systems on the LAN. Ryuk attempts to wake LAN hosts by sending them a Wake-on-LAN (WoL) magic packet. If a host responds, Ryuk tries to mount it as a network drive, using Server Message Block, and encrypt its contents.”]
Source: https://www.crowdstrike.com/blog/wizard-spider-adds-new-feature-to-ryuk-ransomware/