{"id":36757,"date":"2025-06-30T12:15:59","date_gmt":"2025-06-30T12:15:59","guid":{"rendered":"https:\/\/fidelissecurity.com\/?post_type=cybersecurity-101&p=36757"},"modified":"2025-08-07T17:34:56","modified_gmt":"2025-08-07T17:34:56","slug":"ryuk-ransomware","status":"publish","type":"cybersecurity-101","link":"https:\/\/fidelissecurity.com\/es\/cybersecurity-101\/cyberattacks\/ryuk-ransomware\/","title":{"rendered":"What is Ryuk: Complete Guide to the Notorious Ransomware"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In September 2020, Universal Health Services faced a devastating cyberattack that forced over 400 medical facilities across the United States and United Kingdom to revert to paper-based procedures. This wasn\u2019t just another ransomware attack – it was Ryuk<\/i><\/b>, one of the most sophisticated and financially devastating ransomware families ever created.<\/span>\u00a0<\/span><\/p>

Since its emergence in August 2018, Ryuk has distinguished itself from other ransomware through its targeted approach, focusing on \u201cbig game hunting\u201d rather than indiscriminate attacks. Unlike most ransomware<\/a> families that cast wide nets hoping to catch numerous small victims, ryuk ransomware specifically targets large organizations with the resources to pay substantial ransom payments.<\/span>\u00a0<\/span><\/p>

Understanding what Ryuk is and how it operates has become crucial for organizations worldwide. This comprehensive guide will explore everything you need to know about this notorious malware, from its technical capabilities to prevention strategies that can protect your organization from becoming the next victim.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Understanding Ryuk Ransomware<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ryuk is a highly targeted ransomware variant derived from the earlier hermes ransomware family, but it has evolved far beyond its predecessor\u2019s capabilities. Unlike broad-spectrum malware that attempts to infect as many systems as possible, Ryuk uses \u201cbig game hunting\u201d tactics to target high-value organizations including hospitals, government agencies, universities, and large corporations.<\/span>\u00a0<\/span><\/p>

What makes Ryuk particularly dangerous is its ability to encrypt not just local system files, but also network drives and resources accessible to the infected machine. The ransomware actively seeks to disrupt backup and recovery mechanisms by deleting Windows Volume Shadow Service (VSS) shadow copies, making it nearly impossible for victims to restore their data without paying the ransom.<\/span>\u00a0<\/span><\/p>

Files encrypted by Ryuk typically receive file extensions like .ryk or .RYK, making them completely inaccessible without the proper decryption key. The malware creates ransom notes named \u201cRyukReadMe.txt\u201d in every affected directory, containing instructions for contacting the ryuk attackers and payment details.<\/span>\u00a0<\/span><\/p>

The sophistication of ryuk ransomware extends to its operational security. The malware is programmed to avoid infecting systems configured with Russian, Ukrainian, or Belarusian language settings, strongly indicating the geographic preferences and potential nationality of its operators.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Ryuk\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Origins and Attribution<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

First detected in August 2018, Ryuk emerged as a heavily modified version of the older hermes ransomware. The transformation wasn\u2019t merely cosmetic – ryuk operators had fundamentally reimagined how ransomware could be deployed for maximum impact and profit.<\/span>\u00a0<\/span><\/p>

The name \u201cRyuk\u201d references a death god character from the popular Japanese manga and anime series \u201cDeath Note.\u201d This choice reflects the operators\u2019 attention to impactful branding and cultural references, suggesting a level of sophistication that extends beyond mere technical capabilities.<\/span>\u00a0<\/span><\/p>

WIZARD SPIDER, a Russian-speaking cybercriminal organization, is attributed as the primary operator behind ryuk attacks. This group previously operated a subgroup called GRIM SPIDER, which was later merged under the WIZARD SPIDER umbrella. The organization has demonstrated remarkable adaptability, continuously evolving their tactics and incorporating new techniques to maintain their effectiveness.<\/span>\u00a0<\/span><\/p>

The attribution to WIZARD SPIDER is supported by several technical and operational indicators. Beyond the language avoidance mentioned earlier, the group\u2019s command and control infrastructure, malware distribution methods, and tactical patterns all point to a highly organized criminal enterprise with significant resources and technical expertise.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Intelligence agencies and cybersecurity researchers have tracked WIZARD SPIDER\u2019s activities across multiple campaigns, revealing a group that <\/span>operates<\/span> with the precision and planning typically associated with nation-state actors, despite their purely criminal motivations.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Don\u2019t Let Ryuk Win: Outsmart Ransomware with Multi-Layered XDR<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t