Summary

Ryuk is a ransomware which gained notoriety last December 2018 when it disrupted the operations of several major U.S. newspapers. Earlier analysis from Checkpoint in August 2018 noted that Ryuk was being used exclusively for targeted attacks, with its main targets being the critical assets of its victims. A few months before the December attack, the Ryuk attack managed to extort over US$600,000 worth of bitcoins from various large enterprises.

Ryuk Ransomware is operated by a Russia-based criminal group, WIZARD SPIDER, since August 2018. Targeting large organizations for a high-ransom return (big game hunting). This group is known for the operation of Trickbot banking malware. Identifying Ryuk’s infection vectors is difficult given the ransomware will typically delete all evidence of its dropper as part of its routine.

A recent flash update from the FBI revealed that over 100 organizations around the world have been beset by Ryuk attacks since August 2018. The victims come from different industries, with the most common ones being logistics and technology companies, as well as small municipalities. The update also mentioned that identifying Ryuk’s infection vectors is difficult given the ransomware will typically delete all evidence of its dropper as part of its routine. However, given previous incidents, delivery methods for Ryuk can be highly varied — for example, it can be dropped by other malware such as Emotet or Trickbot. Attackers can also take advantage of flaws or weak points in the system to gain access to an organization’s network.

Behaviors

• Bypasses anti-virus products
• Maintains persistence on the targeted machine
• Runs as legitimate process by injecting to Windows process
• Terminates processes
• Stops services

Capabilities

• Information Theft
• File Encryption
• Disabling usage capability

Infection Routine

Impact

• Data loss - loss of important files, documents and other data upon encryption
• Financial loss - users are asked to pay in order to decrypt files that were affected

File Reputation

Predictive Machine Learning

Behavior Monitoring

Web Reputation

Anti-Spam

Network Patterns