Ryuk

Description

Ryuk is a targeted ransomware operation that has affected numerous organizations worldwide, including hospitals, municipalities, and large enterprises. Its operators demanded ransoms that rank among the largest on record, deployed the payload only after thorough reconnaissance, and extracted hundreds of millions of dollars in total. The family operated within the Wizard Spider and Conti ecosystems, and although its peak has passed, its tactics shaped the big game hunting model that dominates ransomware today.

Stats

First seen: February 2022
Last seen: October 2026

MITRE ATT&CK techniques

22 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
T1078Valid Accounts
- T1078.002Domain Accounts
T1134Access Token Manipulation
T1205Traffic Signaling

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1083File and Directory Discovery
T1614System Location Discovery
- T1614.001System Language Discovery
T1680Local Storage Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1222File and Directory Permissions Modification
- T1222.001Windows Permissions
T1685Disable or Modify Tools

Associated groups

Alert name variants

Alert Name	Engine
Dump:Generic.Ransom.Ryuk.00CE8B75	AV
Gen:Variant.Ransom.Ryuk.19	AV
Gen:Variant.Ransom.Ryuk.5	AV
Gen:Variant.Ransom.Ryuk.50	AV
Gen:Variant.Ransom.Ryuk.58	AV
Gen:Variant.Ransom.Ryuk.59	AV
Gen:Variant.Ransom.Ryuk.60	AV
Gen:Variant.Ransom.Ryuk.83	AV
Gen:Variant.Ransom.Ryuk.85	AV
Gen:Variant.Ransom.Ryuk.93	AV
Generic.Ransom.Ryuk.00FD0BC1	AV
Generic.Ransom.Ryuk.13F841EE	AV
Generic.Ransom.Ryuk.4BD167C1	AV
Generic.Ransom.Ryuk.B.2F06B840	AV
Generic.Ransom.Ryuk.B.75F12CB7	AV
Generic.Ransom.Ryuk.C787D6CB	AV
Generic.Ransom.Ryuk.CA7221EC	AV
Script-BAT.Trojan.Ryuk	ATP Sandbox Adv. Heuristics
Shortcut.Ransomware.Ryuk	ATP Sandbox Adv. Heuristics
Trojan.Ransom.Ryuk.A	AV
Trojan.Ransom.Ryuk.B	AV
Trojan.Ransom.Ryuk.F	AV
Win32.Ransomware.Ryuk	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Ryuk	ATP Sandbox Adv. Heuristics
Win64.Trojan.Ryuk	ATP Sandbox Adv. Heuristics