Experts from the Talos Security Management division of Cisco argue that the next natural step in the evolution for ransomware actors is to incorporate the self-replication characteristics that were found in the old-school worms—viruses that brought devastation during the ’90s and early 2000s.

Their think-tank experiment sees attackers using penetration frameworks to create much more flexible ransomware families, which, in addition to using encryption to lock down a user's files, will also incorporate different modules, among which they think a self-propagation component is going to be included.

Cisco staff have already observed such features, even if they exist in a limited and simplistic way in the SamSam ransomware, also known as Samas .

With SamSam making waves and some high-profile victims in the healthcare sector, Cisco expects other ransomware authors to leverage their models and focus more on compromising networks and letting the ransomware seek out and infect other computers on its own.

This type of behavior maximizes the infection rate of a campaign and brings the human factor into the equation. Instead of having to trick every ransomware victim into downloading and executing malicious files, these new types of ransomware will only need one or two people to fall victim.

Infections with these types of threats can go viral, affecting dozens, hundreds, or even thousands of computers, especially in larger government or corporate networks, where most of these workstations are connected to each other.

While companies and government agencies set strong defenses, you rarely find internal networks that are divided into segments (segmented) and internally, as standard security procedures dictate.

Cisco calls this new type of ransomware a "cryptoworm," and it's not without reason. All crooks have to do is throw the ransomware in all directions and let it do its thing.

So far, no such ransomware has even come close to Cisco 's idea , which was inspired by the SamSam detection, but tools such as Rapid7's Metasploit, Strategic Cyber's Cobalt Strike, or Raphael Mudge's Armitage could prove very useful for creating such ransomware.