Ryuk

MITRE ATT&CK: S0446 View on attack.mitre.org

Aliases: Ryuk

Malware type
ransomware
Family
Malware family
Operating systems
windows
Related IoCs
11 (10 malicious)
Last IoC activity
2026-10-13 05:42:27
Profile updated
2026-07-07 12:37:56

Targeted industries: energy-and-utilities financial-services government-and-public-sector healthcare-and-pharmaceutical retail-and-hospitality

Context

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. Ryuk shares code similarities with Hermes ransomware.

Recent IoC activity

10 malicious indicators in Maltiverse are attributed to Ryuk (S0446). The 10 most recently updated:

TypeIndicatorUpdatedSources
file sample 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56 2026-10-13 1
file sample jaffacakes118_7455a14760dea378c7884f3946ef9bcdc981316247d2104cd6895486b318ef8a 2026-10-06 1
file sample d7953e6c5c6cca21de1b6db5639e70582ead7f02d4e5b3546d2ff285e283b50e 2026-09-29 1
file sample 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8 2026-09-10 2
file sample SecuriteInfo.com.Win32.HLLM.Gigu.24608.28010.19879 2026-06-21 2
file sample sub_9b86a50b36ae.bin 2026-05-24 1
file sample Chaos.exe 2026-05-01 3
file sample 3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.zip 2026-04-30 1
file sample 860e50.exe 2025-11-02 2
file sample 88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335 2025-09-23 2

Detection coverage

  • 4 YARA rules
  • 556 Sigma rules

Malware & tools used

  • Obfuscated Files or Information (attack-pattern)
  • Native API (attack-pattern)
  • Process Discovery (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Inhibit System Recovery (attack-pattern)
  • System Language Discovery (attack-pattern)
  • Domain Accounts (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Service Stop (attack-pattern)
  • Windows Permissions (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Traffic Signaling (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • Process Injection (attack-pattern)
  • Masquerading (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Access Token Manipulation (attack-pattern)
  • Loss of Productivity and Revenue (attack-pattern)

Used by threat actors

Detection rules

  • CAPE_Ryuk (yara-rule)
  • MALPEDIA_Win_Ryuk_Stealer_Auto (yara-rule)
  • ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 (yara-rule)
  • DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryuk (yara-rule)

Reports & references

  • Mandiant — Pick Six Intercepting A Fin6 Intrusion (report)
  • proofpoint.com — First Step Initial Access Leads Ransomware (report)
  • Microsoft — Human Operated Ransomware Attacks A Preventable Disaster (report)
  • twitter.com — 1321865315513520128 (report)
  • Mandiant — Kegtap And Singlemalt With A Ransomware Chaser (report)
  • gist.github.com — 6Aa7F61246F53A8Dd4Befea86E832456 (report)
  • youtube.com — Watch (report)
  • Mandiant — The Cycle Of Adversary Pursuit (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • CrowdStrike — Report2021Gtr (report)
  • CrowdStrike — Wizard Spider Adversary Update (report)
  • zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
  • Cisco Talos — Ctir Quarterly Trends Q4 2020 (report)
  • Cisco Talos — Quarterly Ir Report Fall 2020 Q4 (report)
  • intel471.com — Conti Ransomware Cooperation Maze Lockbit Ragnar Locker (report)
  • trellix.com — Conti Leaks Examining The Panama Papers Of Ransomware (report)
  • Microsoft — Dismantling Zloader How Malicious Ads Led To Disabled Security Tools And Ransomware (report)
  • youtube.com — Watch (report)
  • sites.temple.edu — Ci Rw Attacks (report)
  • Broadcom/Symantec — The Ransomware Threat September 2021 (report)
  • therecord.media — Darkside Gang Estimated To Have Made Over 90 Million From Ransomware Attacks (report)
  • CISA — Aa20 345A (report)
  • krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
  • news.sophos.com — The Ransomware Threat Intelligence Center (report)
  • public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)

External references