Loading malware…
Ryuk is a targeted Windows ransomware family first observed in 2018 and widely associated with high-impact enterprise intrusions against companies, government entities, and especially healthcare organizations. It is commonly linked to intrusion chains in which initial access or footholds are provided by malware such as Emotet, TrickBot, BazarLoader, IcedID, or ZLoader, after which operators deploy Ryuk manually into selected victim environments. Ryuk is generally assessed to be derived in part from the Hermes ransomware codebase, but it evolved into a distinct family used in hands-on-keyboard operations.
Ryuk encrypts local and network-accessible files and drops ransom notes across affected systems. Variants have used command-line-controlled execution paths, multistage deployment logic, and victim-specific customization. The malware can enumerate running processes, terminate services and processes that may block encryption, and in some cases inject code into other processes using native Windows APIs. Older variants also established persistence through autorun mechanisms, while some reporting notes remote scheduled-task creation as part of execution on other systems.
A notable Ryuk characteristic is its ability to perform network-based encryption across reachable Windows hosts rather than relying solely on local file encryption. It can inspect ARP information, identify live hosts on private networks, attempt access to administrative shares, and encrypt files on remote systems when sufficient privileges are available. Later variants added Wake-on-LAN functionality to power on dormant hosts before attempting encryption. Ryuk does not itself appear to include credential theft or brute-force capability; instead, it typically relies on credentials and access obtained earlier in the intrusion.
Ryuk operations have been tied to broader criminal ecosystems involving TrickBot and Wizard Spider-related activity, and it has often been discussed as a predecessor to Conti. The family became notable for large ransom demands and disruptive attacks against critical sectors. Separate reporting has also described a likely related tool, Ryuk Stealer, used for selective file theft, reflecting the broader trend toward combining data theft with ransomware extortion, although definitive proof of its use in every Ryuk incident is not available.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
To quickly gain Windows domain admin credentials, Carmakal told BleepingComputer that the group had been seen using the Windows ZeroLogon vulnerability. For this reason, users must install necessary patches on all Windows servers. | the U.S. government warned healthcare providers that Ryuk ransomware is actively targeting the healthcare industry
15 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...this included Trickbot, Emotet, BazarLoader, IcedID, CobaltStrike, and the Ryuk, Conti, and Quantum ransomware strains.
Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware.
Conti popularized the modern ransomware model with its original project, Ryuk, which was delivered via Emotet dropping Trickbot.
À l’été 2020... un incident ayant abouti six semaines après la compromission initiale au chiffrement de la victime par le rançongiciel Ryuk.
The TrickBot Gang... commonly leading to Conti and Ryuk ransomware attacks... other ransomware operations linked to TrickBot, such as Conti and Ryuk...
The threat actor behind it is known to act quickly, using the well-known post-exploitation tool Cobalt Strike to move laterally on the company network infrastructure and deploy ransomware like Ryuk or Conti as a final stage.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
インジェクションの手口は、マルウェアにおいては非常にスタンダードなWriteProcessMemoryによるもので、自分自身をインジェクションし、相手のプロセス内からも不正活動を開始させます。
具体的には、現在のネットワークアダプタに関連付けられた端末のIPアドレスを取得し、[10.][172.16.][192.168.]で始まるかどうか(つまりプライペートIPの範囲かどうか)を調べます。
Ryukの該当機能は、「NT AUTHORITY」(つまりシステム関連)に属するプロセスのリストを作成し、それらのうち「csrss.exe」「explorer.exe」「lsass.exe」以外の全プロセスを対象にインジェクションを行います。
Ryukは上記のように眠っていた端末を起こした後、ping送信による疎通確認を利用してネットワーク上に現存する端末を探索していきます。
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
It was able to gain access via Remote Desktop Services or other direct methods
pingの応答があった端末が見つかった場合、該当端末の管理共有(C$等)にアクセスを試みます。管理共有にアクセスできた場合、配下の全てのファイルを暗号化していきます。
Working with TrickBot, Conti quickly became one of the most profitable and prolific ransomware syndicates. | Ryuk ransomware, which was active from mid-to-late 2018, was responsible for a high number of ransomware attacks resulting in millions of USD in losses.
To reduce the likelihood of being detected by an antimalware product, TrickBot also tries to disable and delete Windows Defender.
This campaign used many advanced persistence, lateral movement, and detection evasion measures, including attempts to disable Windows Defender, the use of EternalBlue to spread, and the stopping of multiple services and processes related to anti malware products.
306 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ryuk is ransomware associated in the article with TrickBot-enabled intrusions and discussed as a possible predecessor or related lineage to Conti.
Related Articles: Ryuk ransomware member pleads guilty in the US, faces 15 years in prison
Ryuk is ransomware that encrypts files using RSA and AES, appends the .ryk extension, creates a new thread for each file, deletes shadow copies, disables recovery options, adjusts permissions to access drives, duplicates itself, and uses self-injection and string obfuscation to evade detection while accelerating encryption speed.
A ransomware family identified as part of the Trickbot Group ecosystem.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.