Ryuk

Malware & Tools · Ryuk

· MalwareS0446 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. Ryuk shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)

Tactic Coverage

stealth (7)discovery (5)privilege escalation (5)persistence (4)execution (3)impact (3)defense impairment (2)lateral movement (1)initial access (1)command and control (1)

Used By (2 groups)

G0037FIN6Magecart Group 6, ITG08 G0102Wizard SpiderUNC1878, TEMP.MixMaster

Techniques (22)

T1016System Network Configuration Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1027Obfuscated Files or Information

stealth

T1036Masquerading

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1053.005Scheduled Task

executionpersistence

References

https://attack.mitre.org/software/S0446 https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html