Loading story…
Researchers documented a malware family dubbed Ryuk Stealer that searches infected systems and mapped network shares for high-value documents, then uploads matching files to attacker-controlled FTP servers. The malware focuses on sensitive .docx, .xlsx, and other selected file types, filtering them by filename and, in newer variants, by file contents using keywords tied to military, government, law enforcement, banking, finance, personal, and confidential material; some samples also look for U.S. Social Security number-like patterns.
Technical analysis found multiple links to the Ryuk ransomware ecosystem, including overlapping exclusion logic, an unused function that appends the .RYK extension, and development metadata, although researchers said attribution to the Ryuk operators remains unconfirmed. Later samples adopted a more complex three-stage packed design, used Windows callback and hidden-window techniques such as RegisterClassEx and CreateWindowEx to unpack and run payloads, could delete a supplied file path for cleanup, and were capable of probing nearby hosts through ARP-derived network information and administrative shares, indicating a tool built to steal valuable data before or alongside ransomware activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A newer Ryuk Stealer sample carried a PE header compile timestamp of 2020-01-19 00:11:32. This sample later became the basis for technical analysis of an expanded and more heavily packed variant.
A newer Ryuk Stealer sample was identified in late January 2020. This variant expanded targeting beyond Office files and introduced more advanced packing and execution techniques.
Researchers found the 2019 Ryuk Stealer variant scanned local drives and network shares for valid .docx and .xlsx files whose filenames matched sensitive keywords tied to finance, government, military, law enforcement, and personal data. Matching files were uploaded to an attacker-controlled FTP server, and the sample showed code-level ties to Ryuk ransomware without proving common operators.
The first known Ryuk Stealer sample was discovered in September 2019. It was identified as a file-stealing malware family focused on collecting sensitive documents rather than encrypting them.
Researchers discovered a new Ryuk Stealer variant that added file-content scanning, targeted more file types including .pdf, .doc, .xls, .cpp, .h, wallet.dat, and .jpg, and searched for a broader set of military, government, banking, law-enforcement, and personal-data keywords before exfiltration. The malware uploaded matching files to attacker-controlled FTP infrastructure, though the embedded FTP sites were down when reported.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ryuk ransomware evolved from a targeted enterprise threat with code similarities to **HERMES** into a faster, more evasive operation that encrypted local disks in under 10 minutes, spread to network shares, deleted shadow copies, disabled recovery options, and in some cases used **Wake-on-LAN** functionality to reach additional systems. Researchers reported that newer variants obfuscated strings, duplicated themselves under random `lan.exe` filenames, used combined **RSA** and **AES** encryption, and partially encrypted large files to speed attacks; one later change also introduced a flaw in the attackers’ own decryptor that could corrupt large virtual disk and database files even after ransom payment.
Aug 15, 2026
North Korea-linked **Kimsuky** has been tied to a series of phishing campaigns that delivered malware through files disguised as PDFs, resumes, questionnaires, and North Korea-related consultation documents. Across the observed intrusions, victims were lured into opening password-protected archives, enabling Office macros, or executing VBS and CHM files, after which the malware launched follow-on payloads through tools such as `wscript.exe`, `mshta.exe`, `regsvr32.exe`, and PowerShell. The implants opened decoy documents to reduce suspicion, established persistence with scheduled tasks, Startup-folder copies, or `HKCU\Run` entries, and contacted attacker-controlled infrastructure including `kro.kr`, `webcindario`, and PHP-based command-and-control endpoints. The recovered payloads show Kimsuky broadening from simple downloaders into multi-stage surveillance and theft malware. Reported capabilities include host reconnaissance, browser and email data theft, crypto-wallet artifact collection, file upload and download, keylogging, clipboard capture, active-window monitoring, and registry changes that weaken Microsoft Office security settings. Researchers also linked newer operations to a wider infrastructure ecosystem, including SharpExt-related panels and a compromised site used to deliver browser-extension malware, while one later campaign exfiltrated stolen victim data through the **GitHub API** instead of FTP, indicating continued adaptation in both delivery and collection methods.
Aug 15, 2026
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026