Ruby

First seen

2022-05-10 00:00:00

Malware type

ransomware

Profile updated

2026-07-07 15:55:01

Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector transportation-and-logistics retail-and-hospitality

Context

Ruby is a ransomware that encrypts files on infected systems, demanding a ransom for decryption keys. It targets various industries such as financial services and healthcare, focusing on maximizing disruption and extortion potential.

Detection coverage

• 1 YARA rules

Detection rules

• SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine (yara-rule)