{ "family": "ryuk", "sample_count": 210, "category": "ransomware", "description": "Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the Russian cybercriminal syndicate Wizard Spider (tracked by threat analysts as UNC1878 and TEMP.MixMaster). Derived directly from the Hermes ransomware codebase originally attributed to the Lazarus Group, Ryuk pioneered the targeted 'big game hunting' methodology against high-value commercial targets, local municipalities, and healthcare networks. Rather than deploying via indiscriminate spray-and-pray spam, Ryuk was deployed as the devastating final payload of complex multi-stage intrusion campaigns initiated by TrickBot, Emotet, or BazarLoader. Once initial network access was secured, operators conducted extensive Active Directory reconnaissance using BloodHound and AdFind, escalated privileges to Domain Admin using Zerologon (CVE-2020-1472), and mapped enterprise network shares. In a devastating technical innovation, Ryuk operators weaponized Wake-on-LAN (WOL) magic packets across local subnets to wake powered-down corporate workstations and servers before triggering encryption. Ryuk executes a multi-threaded hybrid encryption routine pairing ChaCha20 symmetric stream ciphers with RSA-4096 asymmetric public keys, appending the '.RYK' extension to targeted files. Prior to encryption, the malware terminates over 40 security and backup services using net stop, kills 150+ database and system processes via taskkill, and systematically deletes Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet and bcdedit.exe to prevent system restore. CISA released Alert AA20-302A warning of widespread Ryuk ransomware attacks targeting the U.S. healthcare and public health sector.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Ryuk Ransomware", "Trojan.Ransom.Ryuk", "Win32/Ryuk", "Ransom.Ryuk", "Hermes-Ryuk" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Ryuk ransomware and who operates it?", "acceptedAnswer": { "@type": "Answer", "text": "Ryuk is an enterprise-targeting ransomware family operated by Russian cybercrime group Wizard Spider (UNC1878). First discovered in August 2018, it is based on the Hermes ransomware codebase and specializes in high-value big game hunting." } }, { "@type": "Question", "name": "How did Ryuk operators achieve lateral movement across networks?", "acceptedAnswer": { "@type": "Answer", "text": "Wizard Spider utilized TrickBot and BazarLoader for initial access, harvested Active Directory credentials with Mimikatz, exploited Zerologon (CVE-2020-1472) for domain dominance, and moved laterally using PsExec, Cobalt Strike, and WMI." } }, { "@type": "Question", "name": "How did Ryuk use Wake-on-LAN (WOL)?", "acceptedAnswer": { "@type": "Answer", "text": "Ryuk sent Wake-on-LAN broadcast magic packets to all discovered MAC addresses on local subnets to power on sleeping workstations and laptops, ensuring maximum encryption coverage across corporate environments." } }, { "@type": "Question", "name": "What encryption algorithms does Ryuk utilize?", "acceptedAnswer": { "@type": "Answer", "text": "Ryuk generates a unique ChaCha20 symmetric key to encrypt each file, which is then encrypted using an embedded 4096-bit RSA public key, rendering file recovery mathematically impossible without the operator's private master key." } }, { "@type": "Question", "name": "What was the healthcare attack wave detailed in CISA Alert AA20-302A?", "acceptedAnswer": { "@type": "Answer", "text": "In October 2020, CISA, the FBI, and HHS issued Joint Advisory AA20-302A warning of an imminent, coordinated wave of Ryuk ransomware attacks aimed at crippling hospitals and healthcare providers across the United States." } }, { "@type": "Question", "name": "How can organizations defend against Ryuk infections?", "acceptedAnswer": { "@type": "Answer", "text": "Patch Zerologon (CVE-2020-1472), restrict lateral movement via SMB and PsExec, deploy immutable offline backups, and block TrickBot and BazarLoader loaders at the email gateway." } }, { "@type": "Question", "name": "How did Ryuk operators exploit wake-on-LAN (WOL) to encrypt offline workstations?", "acceptedAnswer": { "@type": "Answer", "text": "In advanced network intrusions, Ryuk operators integrated Wake-on-LAN (WOL) packet broadcast routines into their deployment scripts. By broadcasting magic packets across internal subnets prior to launching the encryption binary, Ryuk powered on sleeping or powered-off workstations, ensuring comprehensive encryption coverage across the entire enterprise active directory fleet." } }, { "@type": "Question", "name": "What was the operational relationship between Ryuk, TrickBot, and the Conti ransomware syndicate?", "acceptedAnswer": { "@type": "Answer", "text": "Ryuk was operated by the elite Russian cybercrime syndicate tracked as WIZARD SPIDER. The group utilized Emotet for initial corporate email compromise, followed by TrickBot (and later BazarLoader) for network reconnaissance, privilege escalation, and lateral movement. Once domain administrator rights were obtained, WIZARD SPIDER deployed Ryuk. In late 2020, WIZARD SPIDER phased out the Ryuk codebase in favor of Conti, which featured a faster, multithreaded encryption engine." } } ], "faq_count": 8, "mitre_attack": [ "T1486", "T1490", "T1021.002", "T1059.001", "T1068", "T1003.001", "T1071.001", "T1547.001" ], "cisa_advisory": "AA20-302A", "exploited_cves": [ "CVE-2020-1472" ], "iocs": { "file_hashes": [ "2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b", "5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e", "a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761" ], "delivery": [ "Staged via TrickBot, BazarLoader, and Emotet loaders following corporate network infiltration", "Spear-phishing emails containing malicious macros or weaponized ISO containers", "Exploitation of Active Directory Zerologon flaw CVE-2020-1472 for instant domain compromise" ], "persistence": [ "Creation of service entries with randomized names in Windows Service Control Manager", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to ryuk executable in %PUBLIC%", "Scheduled task configured to launch ryuk binary across all domain-joined endpoints" ] }, "lineage": { "derived_from": [ "hermes" ], "variants": [ "ryuk_v1", "ryuk_v2", "ryuk_wakeonlan", "conti_precursor" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion", "credential_access", "lateral_movement", "impact" ], "last_updated": "2026-10-16", "sources": [ { "name": "CISA Joint Advisory AA20-302A: Ransomware Activity Targeting Healthcare and Public Health Sector", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a" }, { "name": "Mandiant: UNC1878 Wizard Spider Ryuk Intrusion Campaigns", "url": "https://www.mandiant.com/resources/blog/unc1878-ryuk-threat-profile" }, { "name": "CrowdStrike: Wizard Spider Threat Profile and Ryuk Analysis", "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-profile/" }, { "name": "Check Point Research: Ryuk Ransomware Deep Dive", "url": "https://research.checkpoint.com/2018/ryuk-ransomware-targeted-campaigns/" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }