Ryuk

Ryuk is a financially motivated, Russia-linked cybercriminal ransomware operation first observed in August 2018. Also known as the Ryuk gang or Ryuk operators, it is associated with the Wizard Spider cybercriminal ecosystem. Ryuk-associated intrusion activity has also been tracked as UNC1878. Conti succeeded Ryuk, with operational overlap encompassing tooling, management, and intrusion procedures. Ryuk conducts targeted enterprise ransomware attacks against high-revenue companies, hospitals, municipal governments, and other organizations worldwide, including U.S. defense contractors. Its attacks have caused substantial operational disruption, particularly in healthcare. Universal Health Services suffered a Ryuk attack with reported costs of approximately $67 million. Operators have historically demanded multimillion-dollar ransoms, using encryption and interruption of business operations to pressure victims into paying. Ryuk attack chains have used Emotet, TrickBot, QakBot, Zloader, and BazarCall-enabled access to establish footholds in victim networks. Operators perform network reconnaissance, collect administrator credentials, compromise domain controllers, and move laterally before deploying ransomware across enterprise environments. Documented tooling includes Cobalt Strike, PowerShell Empire, Advanced IP Scanner, and SMBAutoBrute. Intrusions have exploited Zerologon (CVE-2020-1472) and abused Active Directory Group Policy for deployment. Operators have also used Ryuk Stealer to exfiltrate sensitive information. Some documented attacks progressed from initial phishing to domain-wide ransomware deployment within two to five hours.