Ryuk ransomware spares Windows Linux installs
Ransomware stops encrypting WSL folders
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A new variant of the Ryuk ransomware now blacklists Linux folders used onWindows 10, so as to avoid encrypting them.
The change avoids affecting the folders for the Windows Subsystem for Linux (WSL), which allows Linux to be installed as a virtual machine onWindows 10.
However, the change isn’t about trying to show kindness to Linux installs, but instead is a purely practical measure - if the ransomware encrypts WSL folders it effectively destroys the Linux virtual machine, meaning there’s no point in paying the attacker for decryption.
Decrypting WSL
There is currently no known variant of Ryuk that specifically targets Linux computers, instead being focused on Windows machines. However, Windows 10 does allow Linux to be directly installed as a virtual machine using the WSL feature.
The feature was introduced byMicrosoftin 2016 in order to improve compatibility between Windows and Linux machines. WSL was released in May 2019 and uses a number of Hyper-V features.
One benefit to Microsoft in adding WSL would be to help Windows users who also need a Linux environment to use features in their Azurecloud computing service.
However, when folders powering WSL are encrypted by ransomware the Linux install is effectively destroyed along with its data. This works against the ransomware attacker’s interests, as even with payment for decryption will not recover the data.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Specific folders now blacklisted against encryption by the Ryuk ransomware include:
The move shows the degree of sophistication and fine-tuning for ransomware, helping to make it a more effective and lucrative business model.
Individuals and businesses are reminded that thebest antivirusoften comes with ransomware protection.
ViaBleepingComputer.
Brian has over 30 years publishing experience as a writer and editor across a range of computing, technology, and marketing titles. He has been interviewed multiple times for the BBC and been a speaker at international conferences. His specialty on techradar is Software as a Service (SaaS) applications, covering everything from office suites to IT service tools. He is also a science fiction and fantasy author, published as Brian G Turner.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
