Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
ryuk Ransomware Group
Ransomware group profile
Description
Ryuk is a ransomware group known for targeting large enterprises and governmental organizations, often demanding substantial ransom payments. The group employs sophisticated tactics to conduct its attacks, often leveraging other malware like TrickBot for initial access. Ryuk has been involved in high-profile incidents and is considered one of the more dangerous ransomware operations globally.
Key insights
- •Ryuk primarily targets large organizations capable of paying high ransoms.
- •The group is associated with the cybercriminal collective Wizard Spider.
- •Attacks often start with phishing emails leading to the deployment of malware like TrickBot.
- •Ryuk encrypts data quickly using AES-256 and RSA-2048 encryption algorithms.
- •The group has been known to disrupt critical infrastructure in healthcare and public sectors.
- •Ryuk's methodologies have influenced subsequent ransomware operations, even after its core group has diminished.
Threat Level & Status Breakdown
For ryuk · Based on incidents in selected period
No victim data for this group in the selected period.
No recent activity in the selected period.
Intelligence
IOCs, YARA/Sigma rules, and related families for ryuk
- ae8acf66bfe3a44148964048b826d005
- f01a9a2d1e31332ed36c1a4d2839f412
- e3e3c28f7a96906e6c30f56e8e6b013e42b5113967d6fb054c32885501dfd1b7
- 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
- 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71
- 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
- e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98
- 4260284ce14278c397aaf6f389c1609b0ab0ce51
- 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
- 000032e3f339f844cc01280d89a3f5147d166326aa179b43c519551f2f11656f
- f84da76ddaf196d12a600f6f4ddda2e2
- 4398670073785d6569ca16b371cac2cdd9007ab3
- 000354e64e175f3f7712448e6b192a5f674e9276c2cc0d42724b5bb6ba8bd8a2
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for ryuk
T1003.001
T1003.001
T1027
T1027
T1083
T1083
T1135
T1135
T1018
T1018
T1059.001
T1059.001
T1486
T1486
T1490
T1490
T1489
T1489
T1078
T1078
T1021.002
T1021.002
T1547.001
T1547.001
Affected countries(14)
Countries where this group has been reported to target or leak victims.