Ryuk Ransomware
Created by the Wizard Spider APT, Ryuk is a comprehensive ransomware tool used as part of larger campaigns against corporate and government organisation in Canada, Europe, and the USA. Attacks with Ryuk typically come after a period of information theft using other tools.
Summary
Created by the Wizard Spider APT, Ryuk is a comprehensive ransomware tool used as part of larger campaigns against corporate and government organisation in Canada, Europe, and the USA. Attacks with Ryuk typically come after a period of information theft using other tools.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in 2018, Ryuk is a ransomware tool used in campaigns against government and enterprise organisations throughout West Europe and North America.
Believed to have been created by the Wizard Spider advanced persistent threat group for use in attacks against high-value corporate targets. Unlike Wizard Spider's older Hermes ransomware, Ryuk does not appear to have been commoditised, instead seeing use only in Wizard Spider's own operations
Delivery
As with Hermes, Ryuk is delivered as a secondary payload in ongoing Trickbot infections. Once Trickbot is itself distributed, either directly from spam emails or via the Emotet trojan, it will open a reverse shell session with a Wizard Spider operator.
This operator then collects sufficient user and system information to identify potential targets before dropping the PowerShell Empire post-exploitation toolkit. They then use this to reconnoitre the affected network, gather credentials, and laterally move to high-value targets. If successful, only then do they install Ryuk.
Activities
Once delivered to a target system, Ryuk will close a large number of security and network services or applications before encrypting all non-system files using a bespoke AES implementation, the keys for which are then encrypted using RSA.
Encrypted files are then appended with the ryk or RYK extension.
Threat updates
| Date | Update |
|---|---|
| 22 Apr 2021 |
Updated hacking techniques
A new method of gaining initial access to networks is being utilised through targeted phishing emails that deliver the malware and then use large-scale brute force to expose users credentials though exposed RDP hosts. The open source tool KeeThief is being used to extract credentials from KeePass password manager, along with deploying a portable version of Notepad++ to run PowerShell scripts. |
| 4 Mar 2021 |
Self-worming capability
A new Ryuk variant has been seen using previously unobserved self-propagation method to move laterally across the local network. This new variant will attempt to obtain all IP addresses stored in the local network ARP cache before sending Wake-on-LAN packets to them. Any devices that responds will have it's shared resources mounted by Ryuk so that may encrypt them. |
| 19 Feb 2021 |
Further healthcare campaigns
There have been new reports of Ryuk attacks against hospitals in France and the USA. |
| 21 Oct 2020 |
Active Zerologon exploitation
Wizard Spider are now using Zerologon exploits in a new Ryuk campaign according to a new report. The group are able to fully compromise a target network in less than 5 hours from initial phishing email delivery. |
| 15 Oct 2020 |
BazarLoader delivery change
A new Ryuk campaign has been observed using the BazarLoader trojan, another Wizard Spider tool, in place of Trickbot. This is likely due to the recent disruption of the Trickbot botnet by US Cyber Command and Microsoft. |
| 31 Dec 2019 |
Unix-like blacklisting
Several new Ryuk variants have been observed that do not target Unix-like operating systems and folders (Linux, BSD, etc), likely in an attempt to prevent operational issues arising from the Windows Subsystem for Linux feature available on Windows 10. |
| 12 Sep 2019 |
New file extraction behaviour
A new variant of Ryuk has been observed attempting to exfiltrate files before encrypting affected systems. This variant will search for files containing sensitive information including banking accounts, financial credentials and military or police-related files. |
| 10 Sep 2018 |
Healthcare campaigns
New information indicates that Ryuk is being targeted at healthcare organisations in the USA and Western Europe. For further information: |
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Definitive source of threat updates
Last edited: 11 January 2022 3:43 pm