Ryuk

How Ryuk typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Ryuk.

1. T1078.002 Domain Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: Ryuk can use stolen domain admin accounts to move laterally within a victim domain.

   What that means: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

2. T1053.005 Scheduled Task ExecutionPersistencePrivilege Escalation

   What they do: Ryuk can remotely create a scheduled task to execute itself on a system.

   What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

3. T1059.003 Windows Command Shell Execution

   What they do: Ryuk has used cmd.exe to create a Registry entry to establish persistence.

   What that means: Adversaries may abuse the Windows command shell for execution.

4. T1106 Native API Execution

   What they do: Ryuk has used multiple native APIs including ShellExecuteW to run executables, GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

5. T1205 Traffic Signaling PersistenceStealthCommand and Control

   What they do: Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.

   What that means: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

6. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

7. T1055 Process Injection Privilege EscalationStealth

   What they do: Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

   What that means: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

8. T1134 Access Token Manipulation Privilege EscalationStealth

   What they do: Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.

   What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

9. T1027 Obfuscated Files or Information Stealth

   What they do: Ryuk can use anti-disassembly and code transformation obfuscation techniques.

   What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

10. T1036 Masquerading Stealth

    What they do: Ryuk can create .dll files that actually contain a Rich Text File format document.

    What that means: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

11. T1036.005 Match Legitimate Resource Name or Location Stealth

    What they do: Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path.

    What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

12. T1222.001 Windows Permissions Defense Impairment

    What they do: Ryuk can launch icacls <path> /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.

    What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

13. T1685 Disable or Modify Tools Defense Impairment

    What they do: Ryuk has stopped services related to anti-virus.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

14. T1016 System Network Configuration Discovery Discovery

    What they do: Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

15. T1057 Process Discovery Discovery

    What they do: Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.

    What that means: Adversaries may attempt to get information about running processes on a system.

16. T1083 File and Directory Discovery Discovery

    What they do: Ryuk has enumerated files and folders on all mounted drives.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

17. T1614.001 System Language Discovery Discovery

    What they do: Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

18. T1680 Local Storage Discovery Discovery

    What they do: Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

19. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: Ryuk has used the C$ network share for lateral movement.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

20. T1486 Data Encrypted for Impact Impact

    What they do: Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

21. T1489 Service Stop Impact

    What they do: Ryuk has called kill.bat for stopping services, disabling services and killing processes.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

22. T1490 Inhibit System Recovery Impact

    What they do: Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Ryuk has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

+27 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

Your network has been penetrated.

All files on each host in the network have been encrypted with a strong algorithm.

Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.

We exclusively have decryption software for your situation
No decryption software is available in the public.

DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.

To get info (decrypt your files) contact us at
[email protected]
or
[email protected]

BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Ryuk
 
No system is safe

Ransom-note text from RansomLook, licensed CC BY 4.0.