A phishing email that evolved into complete domain-wide encryption in less than five hours shows that many organizations remain vulnerable to Ryuk ransomware. While the strategy of attack was the same as those in the past, execution time was much faster, leaving security experts with no time to act. The most recent report of a Ryuk attack completed in 29 hours warned organizations that if a victim missed the first day, they would have precious little time to respond before being ransomed. The current attack makes it clear that organizations must be prepared in advance with techniques that provide an immediate response when malware is deployed.
Ryuk is a sophisticated ransomware threat that targets businesses, hospitals, government institutions, and other organizations. Ryuk first appeared in August 2018, and the resulting attacks have cost victims millions of dollars since then. Instead of focusing on widespread attacks, Ryuk carefully targets and provides undivided attention to create specifically tailored infections with high ransom demands. Expected payments are typically between 15 and 50 Bitcoin which averages between $100,000 and $500,000.
Ryuk sets itself apart from many modern ransomware types with its ability to identify and attack certain data drives while leaving others untouched. Additionally, the ransomware deletes evidence of its existing path. The combination of these actions makes it impossible for the victim to use the Windows Restore option, making it impossible to recover from the attack without external backups.
While Ryuk was first used in 2018, similarities in the ransomware program suggest a relation to the earlier Hermes ransomware threat and a possible connection to Lazarus Group.
Until August 2018, Ryuk was mostly known as a fictional character in the manga series Death Note. The cybercriminal group of the same name began targeting victims in 2018 and managed to obtain $61 million in ransom demands by February 2020. Some of Ryuk’s most notable attacks include publishing companies, major cities, and hospitals. Prominent Ryuk activity includes:
Recent attacks show that Ryuk ransomware isn’t slowing down. The varied history of Ryuk attacks makes it clear that no industry is really safe. Healthcare systems and a number of school systems have even faced attacks. With targeted emails and specific attacks tailored to the company, Ryuk ransomware is difficult to detect until the damage is done.
You could say that Ryuk has a strategy that values quality over quantity. Instead of simultaneously attacking multiple victims, Ryuk targets organizations that are capable of paying a lot of money to quickly get back on track. While victims vary, and the timeframe of a Ryuk attack has become alarmingly streamlined, the system of attack has changed very little. Ryuk ransomware follows these three steps to efficiently carry out an attack.
The idea of having a day or more to determine how to respond to a ransomware attack is no longer feasible. Unfortunately, Ryuk has set the bar, demanding that companies have the capability to prepare for and respond to attacks immediately. By exploiting the Zerologon vulnerability, attackers were quickly able to gain administrator access and deploy Bazar Loader Malware within hours.
The speed and efficiency of the attack are credited in large part to the advantage of the Zerologon vulnerability. Since attackers were able to avoid targeting a high privilege user, fewer security protocols were in place to disturb the attack. Unfortunately, the fact that the attack was targeted at a domain user without other permissions had no effect on the attacker’s ability to successfully move forward. Although the Zerologon vulnerability provided attackers with an easy path to administrator access for this attack, it shows that hackers are evolving with technology and will likely continue to find additional system vulnerabilities to exploit in the future.
Preparation is key when defending your system against swift-moving ransomware attacks. Attackers in the Ryuk group have the knowledge and user experience to carry out largely manual attacks and change up tools of attack as needed. Early Ryuk attacks were largely assisted by TrickBot and Emotet. The most recent attacks have relied on built-in Windows functions and tools like Cobalt Strike. Taking advantage of emerging vulnerabilities like Zerologon provides this group with an added edge to work quickly and complete an attack before it can even be acknowledged.
System users must be aware of the potential threats and how to respond to them. This means all users should receive education about current threats and signs to watch for. Phishing emails often don’t contain malicious software in them. Instead, the targeted user must click a link that deploys the first step in the attack. Some emails that include attachments require users to enable Macros to view them. Users should be aware that infected attachments will automatically drop ransomware when Macros are enabled.
In some cases, organizations have functioning security software that should address the threat. Unfortunately, some IT administrators disable safety measures in the belief it slows down the system. All system users should be educated about the organization’s security software and how it works to prevent attacks.
When vulnerabilities are exposed, any organization should immediately respond to the potential threat. When you are made aware of system vulnerabilities, you can count on the fact that cybercriminals are aware of those potential weaknesses as well. Systems that are not yet patched provide attackers with an easy way to get into your system and quickly complete an attack. Updated patches keep your system secured across all endpoints.
Maintaining data backups is the only way you can ensure you’ll retain data if your organization falls victim to an attack. Keeping a current backup copy of your data on an external cloud server is the only way to restore unencrypted data if you experience an attack. Unfortunately, the manual task of updating backups often means data backups are outdated.
Disaster Recovery as a Service (DRaaS) is a completely hassle-free method of disaster recovery customized to your unique organization. Whether you need a file restored or you must rebuild your entire data center, DRaaS can automatically recover what you need. DRaaS provides local and remote backup with advanced recovery capabilities and enhanced data protection. Instead of simply storing files, Global Data Vault documents the information necessary to bring your entire network back online.
Cybersecurity protection is designed to target current threats and the ways modern cybercriminals attack your system. Invest in a cybersecurity system that uses processes to identify and eliminate the attack style utilized by human-operated ransomware attacks. Your cybersecurity platform should provide these services to help you eliminate threats posed by Ryuk ransomware.
Applying patches to known vulnerabilities is essential to keeping your system secure. However, it’s rarely enough to protect against experienced cybercriminals running advanced ransomware like Ryuk. Organizations also need the ability to monitor and detect when these vulnerabilities are being used against them. BitLyft AIR® is an intelligent cybersecurity platform with the ability to illuminate and eliminate cybersecurity threats before they become a danger to your system. With BitLyft, you not only gain visibility into your system so you know what’s happening and when it happens, but you also get a team dedicated to providing you with the best security experience.