5 Tips to Prevent Ransomware Attacks From Ryuk Malware

Cyber extortion has become an attack of choice for hackers. The average ransomware payment amount as of Q3 2019 was $41,198, with larger enterprises often faced with ransomware demands of over $1 million. It is estimated that these attacks cost the US more than $7.5 billion in 2019 and malware attacks can be expected to increase in 2020. As of now, U.S. law generally does not prohibit paying a ransom, but this may change in the future.

First discovered in mid-August 2018, Ryuk is a type of ransomware that penetrates a target and uses encryption to block access to files, systems, or networks until a ransom is paid. These ransomware attacks cause significant damage, including data loss, disruption of service, downtime, damage to the enterprise or organization’s reputation, and loss of revenue. Currently, Ryuk ransomware is one of the most prevalent variants in the state, local, tribal, and territorial (SLTT) government threat landscape, with infections steadily increasing.

Where did Ryuk ransomware come from?

The fact that Ryuk is a fictional character from the Japanese comic series Death Note, does not reveal much about the malware under the same name. Instead, criminal groups are often tied to their malware by searching for similarities in the code base, structure, language, and attack vectors. Back in 2018, Check Point found a link between Ryuk and another type of ransomware called Hermes. Comparisons between the two indicate that Ryuk was derived from the Hermes source code, although Ryuk only targets enterprise environments and includes modifications such as removing anti-analysis checks.

This connection may also link Ryuk with the North Korean Advanced Persistent Threat (APT) Lazarus Group, a cybercrime group that has been closely connected with Hermes ransomware in the past. Others, including cybersecurity experts at McAfee, FireEye and Kryptos Logic believe that the cybercriminals behind Ryuk ransomware may be linked to two Russian-based cyber-criminal entities: Wizard Spider, the operator of TrickBot and CryptoTech, an organization also linked to Hermes.

As Ryuk’s ransom payments vary widely in amounts and methods, some experts feel there may be more than one criminal group operating Ryuk ransomware. In addition, Ryuk may be sold on the black market to other cyber-criminals seeking to build their own versions of the ransomware.

How does Ryuk ransomware operate?

The cybercriminals behind Ryuk ransomware employ a multi-stage scheme to ensure this malware penetrates their target. Typically, the campaign starts with phishing emails, or by clicking on a deceptive link, or via Remote Desktop Services. When an unsuspecting user unsuspectingly executes the embedded malicious macro, an Emotet bot (Detection name: Trojan-Banker.Win32.Emotet) will automatically be downloaded and infect the machine.

Once the Emotet bot penetrates the machine, it downloads and installs the second piece of malware – Trickbot (verdict: Trojan.Win32.Trickster) – into the infected system. This Trickbot enables cybercriminals to have full visibility into the network and to perform extensive mapping and identification of assets. These criminals can now determine whether the target is worthwhile – for example, a large municipal network or a high-profile enterprise – and if so, they will deploy the Ryuk ransomware to infect as many endpoints and servers as possible, by encrypting both the local drives and network shared folders – and their backups – of the compromised network.

Encrypted files will receive an additional extension (.RYK), and a ransom note “RyukReadMe.txt” from the criminals will appear in every folder on the system. Ryuk generally demands payment via Bitcoin cryptocurrency, and the ransom is typically between 15-50 Bitcoins, which is about $100,000-$500,000, an amount that is ten times the average asking amount, according to ransomware specialists Coveware.

Ryuk’s ability to target backups and use anti-recovery tools are more sophisticated than other types of ransomware, which is why targets generally fail in their recovery efforts unless backups have been stored offline.

How prevalent is Ryuk malware?

As a ransomware targeting enterprises and governments, Ryuk has been wreaking havoc all over the world, although some countries have been affected more than others. According to Kaspersky Security Network’s known cases, the top three countries affected are Germany, China, and Algeria, with the United States ranking at 7^th in the world for Ryuk attacks. This type of attack is on the rise in the United States. See chart below for the percentage of users attacked in each country by Ryuk, relative to users attacked worldwide by this malware: