Ryuk Ransomware Technical Intelligence Dossier

Executive Summary & Threat Architecture

Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the Russian cybercriminal syndicate Wizard Spider (tracked by threat analysts as UNC1878 and TEMP.MixMaster). Derived directly from the Hermes ransomware codebase originally attributed to the Lazarus Group, Ryuk pioneered the targeted 'big game hunting' methodology against high-value commercial targets, local municipalities, and healthcare networks. Rather than deploying via indiscriminate spray-and-pray spam, Ryuk was deployed as the devastating final payload of complex multi-stage intrusion campaigns initiated by TrickBot, Emotet, or BazarLoader. Once initial network access was secured, operators conducted extensive Active Directory reconnaissance using BloodHound and AdFind, escalated privileges to Domain Admin using Zerologon (CVE-2020-1472), and mapped enterprise network shares. In a devastating technical innovation, Ryuk operators weaponized Wake-on-LAN (WOL) magic packets across local subnets to wake powered-down corporate workstations and servers before triggering encryption. Ryuk executes a multi-threaded hybrid encryption routine pairing ChaCha20 symmetric stream ciphers with RSA-4096 asymmetric public keys, appending the '.RYK' extension to targeted files. Prior to encryption, the malware terminates over 40 security and backup services using net stop, kills 150+ database and system processes via taskkill, and systematically deletes Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet and bcdedit.exe to prevent system restore. CISA released Alert AA20-302A warning of widespread Ryuk ransomware attacks targeting the U.S. healthcare and public health sector.

Observed Threat Aliases: Ryuk Ransomware, Trojan.Ransom.Ryuk, Win32/Ryuk, Ransom.Ryuk, Hermes-Ryuk

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: hermes

Documented Downstream Variants: ryuk_v1, ryuk_v2, ryuk_wakeonlan, conti_precursor

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Ryuk Ransomware operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Staged via TrickBot, BazarLoader, and Emotet loaders following corporate network infiltration
• Spear-phishing emails containing malicious macros or weaponized ISO containers
• Exploitation of Active Directory Zerologon flaw CVE-2020-1472 for instant domain compromise

Host Persistence & Execution Hooks

• Creation of service entries with randomized names in Windows Service Control Manager
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to ryuk executable in %PUBLIC%
• Scheduled task configured to launch ryuk binary across all domain-joined endpoints

Reference File Hashes (SHA-256)

• 2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b
• 5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e
• a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761