Recently the City of New Orleans was the victim of ransomware attack, researchers from the
The researcher noticed that this variant of the Ryuk ransomware doesn’t encrypt files in the following *NIX folders:
bin boot Boot dev etc lib initrd sbin sys vmlinuz run var
“At first glance, it seems strange that a Windows malware would blacklist *NIX folders when encrypting files.” reported BleepingComputer.
“A Linux/Unix variant of Ryuk does not exist”
Experts pointed out that known variants of the Ryuk ransomware only targets Windows systems, anyway, Windows 10 implements the Windows Subsystem for Linux (WSL) feature that allows users to install various Linux distributions directly in Windows. The installs utilize folders with the same blacklisted names and likely attackers were not interested in encrypting the *NIX system folders used by WSL to avoid impacting the functionality of the operating system. Don’t forget that the main goal of ransomware is encrypting data without impacting the underlying operating system.