RansomwareATT&CK S0446
Ryuk
Ryuk was a human-operated ransomware family used in targeted, high-ransom attacks on large organisations, including hospitals. A 2020 joint US advisory described it being deployed after earlier TrickBot or BazarLoader infections, with operators spending time in the network before encrypting.
- Public attribution and associated actors
- MITRE ATT&CK lists Ryuk as used by Wizard Spider and FIN6.As publicly reported:Wizard SpiderFIN6
- First seen
- Around 2018
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0446 Ryuk
How it spreads or gets in
- Deployed by operators after an earlier loader infection (TrickBot or BazarLoader, per CISA) gave them access.
- Moved laterally using valid domain accounts and administrative shares.
Key behaviours
- Stopped services and deleted shadow copies before encrypting.
- Used scheduled tasks and Run keys for persistence.
- Injected into other processes to run its encryption.
ATT&CK techniques
- T1078.002Valid Accounts: Domain Accounts
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1053.005Scheduled Task/Job: Scheduled Task
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1055Process Injection
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1489Service Stop
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Treat any TrickBot or BazarLoader detection as a possible precursor to ransomware, not a routine clean-up.
- Alert on domain admin accounts logging on to many hosts in a short time.
- Detect mass service stops and shadow-copy deletion.
Defences that work
- Block macro-enabled attachments and harden email to cut off the loader stage.
- Use tiered administration so domain admin credentials never touch workstations.
- Segment networks and restrict SMB between workstations.
- Keep offline, tested backups.