Security Primer – Ryuk

Ryuk is the most prevalent ransomware variant in the state, local, tribal, and territorial (SLTT) government sector. It is the number one reported variant of 2019, accounting for approximately a quarter of incidents reported to the MS-ISAC. Ryuk and ransomware infections in general continue to increase in tandem with their overall impact and monetary demands. Furthermore, Ryuk’s ability to delete shadow copies and backups makes a Ryuk infection extremely costly and almost impossible to remediate. For instance, an SLTT government paid approximately $600,000 after Ryuk encrypted nearly all the files on their network.

Ryuk uses an advanced three tier encryption model to encrypt files until a ransom is paid. It is often dropped on a system by other malware (e.g., TrickBot) or delivered by cyber threat actors (CTAs) after compromising a system via Remote Desktop Services. Once on a system, CTAs deploy Ryuk throughout the network using PowerShell, PsExec, or Group Policy, with the aim of infecting as many systems as possible.

 

Interested in ransomware? Check out this GovWhitePapers blog post! You can also find ransomware events on our sister site, GovEvents.