Ryuk Ransomware

Created by the Wizard Spider APT, Ryuk is a comprehensive ransomware tool used as part of larger campaigns against corporate and government organisation in Canada, Europe, and the USA. Attacks with Ryuk typically come after a period of information theft using other tools.

Threat ID:: CC-2627
Category:: Ransomware
Threat Severity:: Medium
Threat Vector:: Email spam, Phishing, Insecure network, Vulnerability
Published:: 22 August 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

First observed in 2018, Ryuk is a ransomware tool used in campaigns against government and enterprise organisations throughout West Europe and North America.

Believed to have been created by the Wizard Spider advanced persistent threat group for use in attacks against high-value corporate targets. Unlike Wizard Spider's older Hermes ransomware, Ryuk does not appear to have been commoditised, instead seeing use only in Wizard Spider's own operations

Delivery

As with Hermes, Ryuk is delivered as a secondary payload in ongoing Trickbot infections. Once Trickbot is itself distributed, either directly from spam emails or via the Emotet trojan, it will open a reverse shell session with a Wizard Spider operator.

This operator then collects sufficient user and system information to identify potential targets before dropping the PowerShell Empire post-exploitation toolkit. They then use this to reconnoitre the affected network, gather credentials, and laterally move to high-value targets. If successful, only then do they install Ryuk.

Activities

Once delivered to a target system, Ryuk will close a large number of security and network services or applications before encrypting all non-system files using a bespoke AES implementation, the keys for which are then encrypted using RSA.

Encrypted files are then appended with the ryk or RYK extension.

Threat updates

Date	Update
22 Apr 2021	Updated hacking techniques A new method of gaining initial access to networks is being utilised through targeted phishing emails that deliver the malware and then use large-scale brute force to expose users credentials though exposed RDP hosts. The open source tool KeeThief is being used to extract credentials from KeePass password manager, along with deploying a portable version of Notepad++ to run PowerShell scripts.
4 Mar 2021	Self-worming capability A new Ryuk variant has been seen using previously unobserved self-propagation method to move laterally across the local network. This new variant will attempt to obtain all IP addresses stored in the local network ARP cache before sending Wake-on-LAN packets to them. Any devices that responds will have it's shared resources mounted by Ryuk so that may encrypt them.
19 Feb 2021	Further healthcare campaigns There have been new reports of Ryuk attacks against hospitals in France and the USA.
21 Oct 2020	Active Zerologon exploitation Wizard Spider are now using Zerologon exploits in a new Ryuk campaign according to a new report. The group are able to fully compromise a target network in less than 5 hours from initial phishing email delivery.
15 Oct 2020	BazarLoader delivery change A new Ryuk campaign has been observed using the BazarLoader trojan, another Wizard Spider tool, in place of Trickbot. This is likely due to the recent disruption of the Trickbot botnet by US Cyber Command and Microsoft.
31 Dec 2019	Unix-like blacklisting Several new Ryuk variants have been observed that do not target Unix-like operating systems and folders (Linux, BSD, etc), likely in an attempt to prevent operational issues arising from the Windows Subsystem for Linux feature available on Windows 10.
12 Sep 2019	New file extraction behaviour A new variant of Ryuk has been observed attempting to exfiltrate files before encrypting affected systems. This variant will search for files containing sensitive information including banking accounts, financial credentials and military or police-related files.
10 Sep 2018	Healthcare campaigns New information indicates that Ryuk is being targeted at healthcare organisations in the USA and Western Europe. For further information: HC3 Threat Intelligence Briefing Ryuk Ransomware white paper (USDHHS, 2018)

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

Critical data is frequently saved in multiple backup locations.
At least one backup is kept offline at any time (separated from live systems).
Backups and incident recovery plans are tested to ensure that data can be restored when needed.
User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
Infected systems are disconnected from the network and powered down as soon as practicable.
Any user account credentials that may have been compromised should be reset on a clean device
Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

IP addresses

3.137.182[.]114:443
5.2.64[.]174:443
66.42.76[.]46
88.119.171[.]94:443

Domains

cstr3[.]com
echoservice[.]fr
havemosts[.]com
fdspofsdrtert[.]best
spidersearchshop[.]com
quwasd[.]com

URLs

66[.]42[.]76[.]46/file_server/a8-5
fdspofsdrtert[.]best:443/aajhDIAHFIEHFI

Email addresses

lenmovala1981@protonmail[.]com
melisapeterman@protonmail[.]com
melisapeterman@tutanota[.]com
mirey@tutanota[.]com

Host indicators

MD5 hashes

1354ac0d5be0c8d03f4e3aba78d2223e
29340643ca2e6677c19e1d3bf351d654
31bd0f224e7e74eee2847f43aae23974
3266352bea7513ac3ead6e7d68661ad3
3895a370b0c69c7e23ebb5ca1598525d
3925ae7df3328773be923f74d70555e3
40492c178079e65dfd5449bf899413b6
567407d941d99abeff20a1b836570d30
5ac0f050f93f86e69026faea1fbb4450
5f7dd3740a3a4ea74e2ee234f6de26aa
6cdcb9f86972efc4cfce4b06b6be053a
7a7b67ed6ac37b8dae8e18c7b928313b
86c314bc2dc37ba84f7364acd5108c2b
958c594909933d4c82e93c22850194aa
9f64c8cf2ba268400f51862b635a85b2
aef8a240881322a88d3dafcfdb19ed8a
b0817e2a931d4cb950403b87d1f9cd8c
c0202cf6aeab8437c638533d14563d35
c0d6a263181a04e9039df3372afb8016
cb0c1248d3899358a375888bb4e8f3fe
d348f536e214a47655af387408b4fca5
d4a7c85f23438de8ebb5f8d6e04e55fc
d7697d0d692bd883e53036b906108d56
db2766c6f43c25951cdd38304d328dc1
fca20e17ce8c0c3f3c78d82c953472ed
ff1a26776f66712a8f7cbeda33588909

SHA1 hashes

28d693b03186b7e8985f0cdb1c7f74010b2a6568
29abad9d694a43dafa56e589b07d007128f3063b
2c8ea348cc80ed41737d3d2d8cb5487dcd49d040
3b9ebfd3ad07528923381eb7ca90105a5125334f
4eb0d5fab83c5a92e442beee4b31a6cd7d05cf4e
631ae3e5bb0b791c2926829a00e99154c94621c9
74ea44c6ff5125fa4da154f2ae80d2fd7dd7ab33
7f3fd2fb86e2f3d82fc02b29aaac432c48c713e3
945e0aa129255745eac01089a4f36e0cfc2a2606
948af4614e8ff150fbe0bc38f40806b457acaf3a
98bc2a03618d7112c9cd130c6836c374c2ff4fcf
98e9b71ad8000b4ad7ad3e0875f050dda41ddf7b
9a237247ac1f9f32f874fba12550ba3b9ba233d9
c4f3e9a0dc9b9de53920c4d2fcea8d07f8db2f5b
c8ecc9b34184e7e1c15b4ed49fb838e7882dbfc6
cbff9d66d68fa67e40ca4a295daed68f0d5f8383
d9f8eb52ce514d3dbf8f8e6a1ecb29c1dc46ea12
e953cbfae3a89e3d89d5f613b936525dc0acbf88
fc62460c6ddd671085cde0138cf3d999e1db08cf

SHA256 hashes

113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec
1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56
1b424c3edf0b2e241050345432731cd804b1e273fc3c470d660c66393891cccc
1d8b7faf5f290465cc742e07abca78fac419135b191071cc77912263cd1dde1d
23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2
2a0044c9599a21c45ca22f9abd1e8a3093b3c4046b328968c949a651e6f70357
3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4
501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9
5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5
5cbbf37a1bdcb78f346e94ecca606a661bb49c5c9bb10c99a60ff415e118a482
5e2c9ec5a108af92f177cabe23451d20e592ae54bb84265d1f972fcbd4f6a409
695a716f2c43a69bdd03e74058fa23fb77e596bb4f1f3a021d529c85e9564f7d
6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619
74654957ba3c9f1ce8bb513954b9deea68a5a82217806977a1247fb342db109f
78c6042067216a5d47f4a338dd951848b122bbcbcd3e61290b2f709543448d90
795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f
7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20
7dc3fc208c41c946ac8238405fce25e04f0c2a7a9e1d2701986217bd2445487a
884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5
8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b
901c6c0462442aa2aba443383b459027171dc892ff1772d1e5988f14bf960ab5
9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2
ac648d11f695cf98993fa519803fa26cd43ec32a7a8713bfa34eb618659aff77
b8e463789a076b16a90d1aae73cea9d3880ac0ead1fd16587b8cd79e37a1a3d8
bd364045a7e1736734b94d29120fa4f678aa2a81b49d4cb9d8e37081ca61bad8
ccde47a0d315dcd4740fccfe8e8110fbb1fd85bb305734fec409f52051790c98
c51024bb119211c335f95e731cfa9a744fcdb645a57d35fb379d01b7dbdd098e
d439abbc0c204aa869991837e62e7a5ebf30f5214e6f648c78dc812d4ffd62dd
d67461ba45a4edf3b2a69b3e64303fda8130bd1fc7a1173f35c1fe67b40c9639
d67461ba45a4edf3b2a69b3e64303fda8130bd1fc7a1173f35c1fe67b40c9639
e209429fe9c7ef4218c0e5ef46913031c201ae8e47b5784e3c8ff64b3ebab1c8
f964f962223ae59af3595961f9279c2001d6c85b87d43175eec71c7108cfb3cd
feb8c2bcb71da02dbbeecb999869e053cf96af8cce6f9705cadca4338133d3b5
fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b

YARA rules

Courtesy of NCSC and the Government of Victoria

rule ryuk_custom_packer { meta: description = "Rule for detecting the packed Ryuk binary" author = "NCSC" hash = "b895399bdd8b07b14e1e613329b76911ebe37ab038e4b760f41e237f863b4964" strings: $ = { 55 8b ec 8b 45 08 8d 04 c5 4d 01 00 00 5d c3 } $ = { 83 c4 04 ba ed 6e 46 00 81 ea 1d 4e 06 00 ff e2 8b e5 5d c3 } $ = { ba 01 00 00 00 85 d2 74 02 eb f5 8b e5 5d c3 } $ = { 8b 45 fc 83 c0 02 89 45 fc 81 7d fc 7b a1 c2 00 73 02 eb ec } condition: uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x00004550 and all of them }
rule ryuk_afx_packer { meta: description = "Rule for detecting the packed Ryuk binary" author = "NCSC" hash = "fe55650d8b1b78d5cdb4ad94c0d7ba7052351630be9e8c273cc135ad3fa81a75" strings: $ = { 3C EB AB AD 17 E5 B3 50 80 18 F1 2A 1C 30 CB 82 } $ = "KQAAADFZc3EAAAAAs8ws/pW8/pa4/pa8AWm8/i68/pa8/pa8vpa8/pa8/pa8/pa8/pa8/pa8 /pa8/pa8/pa8/pa8/pa8/pa8/pe8/pijRJi8Sp9x3y69sludqv7VjbbM" ascii $ = { 52 2F 43 34 16 4E 2D 67 16 4E 2D 67 16 4E 2D 67 40 51 3E 67 36 4E 2D 67 16 4E 2D 67 0D 4E 2D 67 74 51 3E 67 07 4E 2D 67 16 4E 2C 67 C3 4F 2D 67 95 52 23 67 0A 4E 2D 67 FE 51 27 67 98 4E 2D 67 FE 51 26 67 4E 4E 2D 67 AE 48 2B 67 17 4E 2D 67 52 69 63 68 16 4E 2D 67 } condition: uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x00004550 and all of them }
rule ryuk_main_artefacts { meta: description = "Rule for detecting the main Ryuk payload" author = "NCSC" strings: $ = ".RYK" wide $ = "RyukReadMe.html" wide $ = "UNIQUE_ID_DO_NOT_REMOVE" wide $ = "\\users\\Public\\finish" wide $ = "\\users\\Public\\sys" wide $ = "\\Documents and Settings\\Default User\\finish" wide $ = "\\Documents and Settings\\Default User\\sys" wide condition: uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x00004550 and all of them }

ATT&CK techniques

Ryuk S0446

NCSC link

https://www.ncsc.gov.uk/news/ryuk-advisory

Definitive source of threat updates

Last edited: 11 January 2022 3:43 pm