Loading story…
Ryuk ransomware evolved from a targeted enterprise threat with code similarities to HERMES into a faster, more evasive operation that encrypted local disks in under 10 minutes, spread to network shares, deleted shadow copies, disabled recovery options, and in some cases used Wake-on-LAN functionality to reach additional systems. Researchers reported that newer variants obfuscated strings, duplicated themselves under random lan.exe filenames, used combined RSA and AES encryption, and partially encrypted large files to speed attacks; one later change also introduced a flaw in the attackers’ own decryptor that could corrupt large virtual disk and database files even after ransom payment.
Pull IOCs and campaign context straight into your stack.
13 events from the most recent confirmed update back to the earliest known activity.
CISA, the FBI, and HHS issued a joint advisory warning of an increased and imminent Ryuk threat to U.S. hospitals and healthcare providers. The agencies also held a call with healthcare organizations and urged immediate defensive measures, including patching and incident-response preparation.
Universal Health Services was hit by a corporate-wide Ryuk ransomware attack in the month before the late-October 2020 reporting. The incident affected more than 200 medical facilities nationwide and disrupted access to labs, radiology, and patient records.
SentinelOne reported that attackers using TrickBot typically spent about two weeks conducting reconnaissance, credential theft, and lateral movement before deploying Ryuk. The analysis described use of Cobalt Strike, DACheck, Mimikatz, and PsExec to profile networks, gain broad access, and remotely launch ransomware.
Epiq Global detected unauthorized activity on February 29, 2020, when Ryuk began encrypting devices on its network. The company took systems offline globally to contain the attack, disrupting e-discovery services and client access to case documents.
Quick Heal published an article titled "A Deep Dive Into Wakeup On Lan (WoL) Implementation of Ryuk," indicating public reporting on Ryuk's Wake-on-LAN functionality. The provided snippet contains no further technical details.
A December 2019 Ryuk sample analyzed by Vitali Kremez was found to avoid encrypting folders such as bin, boot, dev, etc, lib, sbin, sys, and var. Reporting linked the sample to the City of New Orleans incident and said the change likely aimed to avoid damaging Windows Subsystem for Linux installations on infected Windows systems.
A cybersecurity industry source told BleepingComputer that Epiq Global's eventual Ryuk incident began with a TrickBot infection in December 2019. The intrusion reportedly enabled reconnaissance and credential theft before ransomware deployment.
Check Point reported that over a two-week period in 2018, Ryuk severely impacted at least three organizations, encrypting hundreds of PCs, storage systems, and data center assets. The report said operators had already received more than $640,000 in ransom payments and assessed links to HERMES code or operators.
The Virus Bulletin 2019 presentation states that Ryuk was first seen in August 2018 and was mentioned in a tweet on August 17, 2018. This marks the earliest public emergence of the ransomware family in the provided sources.
The HERMES ransomware was used in the October 2017 attack on Far Eastern International Bank in Taiwan, which involved a SWIFT theft of $60 million that was later recovered. This event is cited as background for later Ryuk/HERMES code-link analysis.
Sophos Rapid Response described containing a Ryuk attack at a life sciences research institute that lost about a week of research data and had to rebuild systems before restoring operations. Investigators traced the compromise to malware installed by a university student using personal-device Citrix access without MFA.
Sky Lakes Medical Center in Oregon and St. Lawrence Health System in New York were struck by Ryuk ransomware in the two days preceding the report. The attacks affected patient treatment and were part of a broader wave targeting U.S. healthcare.
Emsisoft disclosed that a recent Ryuk variant changed footer-length handling in a way that caused the attackers' own decryptor to truncate decrypted files by one byte. The flaw could corrupt some file types, especially VHD/VHDX virtual disks and Oracle database files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
11 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcenews.sophos.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcembsd.jp
Open sourceblog.emsisoft.com
Open sourceresearch.checkpoint.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented a malware family dubbed **Ryuk Stealer** that searches infected systems and mapped network shares for high-value documents, then uploads matching files to attacker-controlled FTP servers. The malware focuses on sensitive `.docx`, `.xlsx`, and other selected file types, filtering them by filename and, in newer variants, by file contents using keywords tied to military, government, law enforcement, banking, finance, personal, and confidential material; some samples also look for U.S. Social Security number-like patterns. Technical analysis found multiple links to the **Ryuk** ransomware ecosystem, including overlapping exclusion logic, an unused function that appends the `.RYK` extension, and development metadata, although researchers said attribution to the Ryuk operators remains unconfirmed. Later samples adopted a more complex three-stage packed design, used Windows callback and hidden-window techniques such as `RegisterClassEx` and `CreateWindowEx` to unpack and run payloads, could delete a supplied file path for cleanup, and were capable of probing nearby hosts through ARP-derived network information and administrative shares, indicating a tool built to steal valuable data before or alongside ransomware activity.
Aug 15, 2026
U.S. federal agencies warned that hospitals and healthcare providers faced an **imminent and credible** ransomware threat as multiple organizations were already dealing with disruptive intrusions linked to the **Ryuk** ecosystem. The joint alert from **CISA**, the **FBI**, and **HHS** said the healthcare and public health sector was being actively targeted, while reporting indicated threat actors had discussed deploying ransomware across hundreds of U.S. healthcare facilities. Several hospitals reported operational impacts consistent with the campaign, including **St. Lawrence Health System** in New York and **Sky Lakes Medical Center** in Oregon, while the **University of Vermont Health Network** disclosed a major network outage under investigation as a possible cyberattack. Security researchers and incident responders tied the activity to Ryuk and associated operators, describing it as a significant escalation that disrupted hospital systems, forced some patient diversions, and raised concern that additional healthcare organizations could be hit.
Aug 15, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026