---
title: "Security News in Review: Ryuk Ransomware Develops Self-Replication Capabilities"
description: Ryuk ransomware, high-severity vulnerabilities in the Linux Kernel, and new trends of ransomware gangs - all in this week's Security News in Review.
image: https://www.morphisec.com/hubfs/Ryuk%20ransomware.jpg
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Security News in Review: Ryuk Ransomware Develops Self-Replication Capabilities

Posted by [Matthew Delman](https://1534169.hs-sites.com/author/matthew-delman) on March 6, 2021

Find me on:

[LinkedIn](https://www.linkedin.com/in/matthewdelman/) [Twitter ](https://twitter.com/nerdymarketr)

- [Tweet](https://twitter.com/share)

![Ryuk ransomware](https://www.morphisec.com/hubfs/Ryuk%20ransomware.jpg)

In this week’s edition of our roundup of the cybersecurity news, you’ll find reporting on a new trend of ransomware gangs turning to virtual machines, several high-severity vulnerabilities in the Linux kernel being resolved, and some new capabilities in the Ryuk ransomware. 

Read on for the latest Security News in Review, and let us know if we missed anything. 

[Ransomware hackers turn to virtual machine software to boost extortion schemes](https://www.cyberscoop.com/ransomware-virtual-machine-crowdstrike-hypervisor/) -- Ransomware gangs have started to evolve their attack strategies from directly being written for Microsoft Windows machines to targeting the hypervisor that manages virtual machines. This is shown by some recent code designed to affect ESXi, a hypervisor software, with the goal being to infect the hypervisor and propagate their code to virtual machines. 

[Ryuk ransomware develops worm-like capabilities, France warns](https://www.cyberscoop.com/ryuk-ransomware-develops-worm-like-capabilities-anssi-france/) -- According to an analysis from the French National Agency for the Security of Information Systems, the Ryuk ransomware has developed worm-like self-replicating capabilities. From a functional perspective, this means that the ransomware can propagate without human interaction. The addition of new capabilities to Ryuk will be of special interest to the healthcare sector, where Ryuk ransomware was responsible for 75% of attacks. 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/8d928d32-c3d8-465e-9404-91a6f2196950.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/8d928d32-c3d8-465e-9404-91a6f2196950)

[High severity Linux network security holes found, fixed](https://www.zdnet.com/article/linux-network-security-holes-found-fixed/) -- A set of five critical vulnerabilities in the Linux kernel’s virtual socket implementation were found and fixed recently. The vulnerabilities exist when Linux’s virtual socket multi-transport support is added, which is typically used to facilitate communication between virtual machines and their host. 

[Microsoft Releases Out-of-Band Security Patches for Exchange Server](https://redmondmag.com/articles/2021/03/02/exchange-server-zero-day-patches.aspx) -- Microsoft released several out-of-band security patches for multiple zero-day flaws that are actively being exploited in the wild. Organizations running Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019 products should apply these patches right away. The patches relate to the on-premises versions of Exchange Server, and not to Exchange Online. 

[Google Chrome update fixes another worrying security flaw](https://www.techradar.com/news/google-chrome-update-fixes-another-worrying-security-flaw) -- Google released Chrome version 89 recently to patch a zero-day described by the company as an “object lifecycle issue in audio.” Despite the vague description, the company rated the flaw as high severity and issued a patch to fix it. There are reports of an exploit being used in the wild, but Google did not share any information on potential threats in the update. 

[Payroll/HR Giant PrismHR Hit by Ransomware?](https://krebsonsecurity.com/2021/03/payroll-hr-giant-prismhr-hit-by-ransomware/) -- Payroll provider PrismHR appears to have been hit with a ransomware attack this past weekend. They detected suspicious activity on Sunday, February 28, and disabled platform access for all their users. According to reporting from KrebsonSecurity, their actions since the attack have all the hallmarks of a ransomware infection despite PrismHR not confirming the attack. 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/5d6b375c-4a22-4234-a268-db81f1260b1d.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/5d6b375c-4a22-4234-a268-db81f1260b1d)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/security-news-in-review-ryuk-ransomware-develops-self-replication-capabilities#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Matthew Delman",
    "url" : "https://1534169.hs-sites.com/author/matthew-delman"
  },
  "dateModified" : "2023-08-16T14:30:19.628Z",
  "datePublished" : "2021-03-06T14:00:00.000Z",
  "headline" : "Security News in Review: Ryuk Ransomware Develops Self-Replication Capabilities",
  "image" : [ "https://www.morphisec.com/hubfs/Ryuk%20ransomware.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/security-news-in-review-ryuk-ransomware-develops-self-replication-capabilities",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```