Ryuk Ransomware · 2018-08
Ryuk emerged as a targeted ransomware operation against enterprises, with operators using prior network access, credential collection, lateral movement, and hands-on deployment to encrypt critical systems and disrupt organizations in sectors including government, financial services, manufacturing, service providers, and high tech. Early reporting noted code and artifact overlap with HERMES ransomware previously associated with Lazarus, but later linked reports attributed observed Ryuk operations to crimeware actors using Emotet and TrickBot footholds and stated that North Korean involvement was unproven.
Ryuk Ransomware · 2018-08
Reported: 2018-08; Victims: Ryuk Ransomware; Motivations: FinancialGain; Sectors: None; Countries: United States, Worldwide
A Targeted Campaign Break-Down - Ryuk Ransomware · 2018-08-20
Curiously, our research lead us to connect the nature of Ryuk’s campaign and some of its inner-workings to the HERMES ransomware, a malware commonly attributed to the notorious North Korean APT Lazarus Group, which was also used in massive targeted attacks. This leads us to believe that the current wave of targeted attacks using Ryuk may either be the work of the HERMES operators, the allegedly North Korean group, or the work of an actor who has obtained the HERMES source code.