1. Home
  2. Software
  3. Ryuk

Ryuk

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. Ryuk shares code similarities with Hermes ransomware.[1][2][3]

ID: S0446
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Matt Brenton, Zurich Insurance Group; The DFIR Report
Version: 1.4
Created: 13 May 2020
Last Modified: 22 April 2025
Enterprise Layer
download view
ICS Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1036 伪装

Ryuk can create .dll files that actually contain a Rich Text File format document.[4]
.005 Match Legitimate Name or Location

Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:\Users\Public.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Ryuk has used cmd.exe to create a Registry entry to establish persistence.[1]
Enterprise T1562 .001 妨碍防御: Disable or Modify Tools

Ryuk has stopped services related to anti-virus.[2]
Enterprise T1486 数据加密以实现影响

Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.[1][5]
Enterprise T1083 文件和目录发现

Ryuk has enumerated files and folders on all mounted drives.[1]

Enterprise T1222 .001 文件和目录权限修改: Windows File and Directory Permissions Modification

Ryuk can launch icacls /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.[4]
Enterprise T1078 .002 有效账户: Domain Accounts

Ryuk can use stolen domain admin accounts to move laterally within a victim domain.[4]
Enterprise T1489 服务停止

Ryuk has called kill.bat for stopping services, disabling services and killing processes.[1]
Enterprise T1106 本机API

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.[1]
Enterprise T1205 流量激活

Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.[6]
Enterprise T1027 混淆文件或信息

Ryuk can use anti-disassembly and code transformation obfuscation techniques.[5]
Enterprise T1614 .001 系统位置发现: System Language Discovery

Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage. If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.[1]
Enterprise T1082 系统信息发现

Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.[1]
Enterprise T1490 系统恢复抑制

Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.[1]
Enterprise T1016 系统网络配置发现

Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.[1][6]

Enterprise T1134 访问令牌操控

Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.[1]
Enterprise T1057 进程发现

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.[1]
Enterprise T1055 进程注入

Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.[1]
Enterprise T1021 .002 远程服务: SMB/Windows Admin Shares

Ryuk has used the C$ network share for lateral movement.[6]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

Ryuk can remotely create a scheduled task to execute itself on a system.[4]
ICS T0828 Loss of Productivity and Revenue

An enterprise resource planning (ERP) manufacturing server was lost to the Ryuk attack. The manufacturing process had to rely on paper and existing orders to keep the shop floor open. [7]

Groups That Use This Software

ID Name References
G0102 Wizard Spider

[1][8][9][10][11][12][13][14][5][15][16]
G0037 FIN6

[3]

References

  1. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  2. Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.
  3. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
  4. ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021.
  5. Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.
  6. Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.
  7. Kelly Jackson Higgins How a Manufacturing Firm Recovered from a Devastating Ransomware Attack Retrieved. 2019/11/03
  8. Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.
  1. DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.
  2. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.
  3. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
  4. The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.
  5. The DFIR Report. (2020, October 18). Ryuk in 5 Hours. Retrieved October 19, 2020.
  6. Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.
  7. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.
  8. Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.