Ryuk is a type of ransomware known for targeting large, public-entity Microsoft Windows cybersystems. It typically encrypts data on an infected system, rendering the data inaccessible until a ransom is paid in untraceable bitcoin. Ryuk is believed to be used by two or more criminal groups, most likely Russian or Ukrainian, who target organizations rather than individual consumers.
Origin The Ryuk ransomware first appeared in 2018. Ryuk was initially suspected to be of North Korean origin, then later thought to have been created by only one group or actor. It is now suspected that Ryuk has been created by multiple Russian criminal cartels. The criminal group known as Ryuk seeks primarily to extort ransom payments to decrypt the data that its malware has encrypted and as a result rendered useless. Following an attack on the Baltimore County (Maryland) school system in November 2020, a cybersecurity threat analyst said to the Baltimore Sun, the Ryuk criminal group "tends to be all business ... they just like to get the job done": to extort a large ransom payoff.
How it works In the UK, the National Cyber Security Centre notes that Ryuk uses Trickbot computer malware to install itself, once access is gained to a network's servers. It has the capability to defeat many anti-malware countermeasures that may be present and can completely disable a computer network. It can even seek out and disable backup files if kept on shared servers. Emotet is also used by Ryuk hackers to gain access to computers as the initial loader or "Trojan horse". The U.S. Cybersecurity and Infrastructure Security Agency (CISA) website provides detailed information on how Ryuk infects and takes control of a computer network, saying that access may be initially gained by: "... phishing campaigns that contain either links to malicious websites that host the malware or attachments with the malware. Loaders start the infection chain by distributing the payload; they deploy and execute the backdoor from the command and control server and install it on the victim’s machine". The phishing efforts generally contain malicious documents (or hyperlinks to them). When the victim enables it, a malicious macro or loader starts the infection sequence. Like many other ransomware families, Ryuk deletes shadow copy files and stops processes from the hardcoded list. Once Ryuk takes control of a system, it encrypts the stored data, making it impossible for users to access unless a ransom is paid by the victim in untraceable bitcoin. In many cases, days or weeks may elapse between the time hackers initially gain access to a system before the massive encryption occurs, as the criminals penetrate deeper into the network to inflict maximum damage. Ryuk is an especially pernicious type of malware because it also finds and encrypts network drives and resources. It also disables the System Restore feature of Microsoft Windows that would otherwise allow restoring the computer's system files, applications, and Windows Registry to their previous, unencrypted state. To combat these ransomware attacks, the U.S. Cyber Command initiated a counter-attack in September, 2020, to disconnect Trickbot from internet servers. Shortly thereafter, Microsoft invoked trademark law to seize Trickbot servers, disrupting a Ryuk botnet.
… excerpt ends here. Continue reading the full article.
