The Rise of Ryuk: Defending against a deadly new ransomware

Tim Bandos, CISO at Digital Guardian, looks at the rise of a new kind of ransomware and how best to counter its threat




The explosive growth of Ryuk ransomware has resulted in a massive 40% surge in the total number of ransomware attacks reported in Q3 2020 compared to the same period in 2019, taking the global total to over 200 million. While Ryuk ransomware isn’t totally new (having first appeared in 2018), the past twelve months has seen its popularity soar among cybercriminals.

The latest figures show Ryuk detections have risen from just 5,123 in Q3 2019 to over 67 million in Q3 2020 – equating to roughly a third of all ransomware attacks carried out in the quarter. So, what is Ryuk ransomware and how are criminals using it to target organisations, particularly in the healthcare sector?


What is Ryuk?


Ryuk is a highly sophisticated type of ransomware that’s being used to target organisations all over the world, locking them out of their computer networks and files until a ransom is paid. Once deployed, Ryuk encrypts all target files using a strong encryption based on AES-256 except those with the extensions dll, lnk, hrmlog, ini and exe. It also skips files stored in the Windows System32, Chrome, Mozilla, Internet Explorer and Recycle Bin directories. These exclusion rules are presumably intended to preserve system stability, enabling victims to access and use a browser to make ransom payments.

Like many ransomware programs, Ryuk also attempts to delete volume shadow copies in order to prevent victims from recovering their data through alternative means. 



Read more: What security risks are associated with USB media?



When the victim has been infected, the perpetrators set ransom demands according to perceived ability to pay. According to researchers, the average ransom collected is around $750,000 (paid in Bitcoin), but the highest known payment to date is believed to be an eye-watering $34 million, paid by an unknown company in exchange for the decryption key.

The Russian group behind the attacks is known for using highly effective manual hacking techniques and open-source tools to move laterally inside compromised networks. Doing so helps them gain access to as many administrative areas as possible, as well as erase/cover their tracks before detonating the ransomware, with devastating results.


Who’s being targeted?


Data shows a wide range of sectors are being targeted, but one of the primary targets appears to be healthcare and social services providers, many of whom are particularly vulnerable at the moment due to the ongoing Coronavirus pandemic. This is because hospitals and healthcare facilities often have a wealth of legacy network infrastructure that’s inadequately protected from cyber attacks of this nature. When combined with the chaos and stretched resources caused by the pandemic, they become the perfect victims.  

In the last few months, attacks have disrupted hospitals across the world with deadly consequences.  In September, an attack disabled computer systems at Düsseldorf University Hospital in Germany, leading to one patient dying as doctors tried to transfer her out of the facility.  Ryuk is also believed to be behind the recent ransomware attack on Universal Health Services (UHS), which runs approximately 400 hospitals and care centres across the US and UK, making it one of the largest medical cyberattacks in US history.


What can organisations do to effectively protect themselves?


Fortunately, the cybersecurity industry has taken numerous steps to help organisations defend themselves against the rise of Ryuk. Many advanced threat protection (ATP) providers such as Digital Guardian have already released free policy packs that enable customers to update their existing security tools and solutions to rapidly detect signature network activities that indicate a potential attack is in progress. These include the detection of mass file editing to known Ryuk ransomware extensions, deletion of volume shadow copies, and attempts to connect to known command and control infrastructure associated with the ransomware campaign. Elsewhere, organisations can implement the following basic steps to bolster their cybersecurity defences against threats like Ryuk:

  • Maintain regular data backups – conducting regular backups of all key organisational data is one of the best ways to minimise disruption in the event of a successful breach. Storing these backups securely, away from the main network, will prevent them from being deleted or encrypted as part of an attack.
  • Keep security patches up to date – as mentioned above, cybersecurity vendors are already well aware of Ryuk and the vast majority have updated their products and solutions to detect its signatures. However, these updates only come into effect when customers install the latest security patches on their networks. As such, it’s critical that such patches are installed as soon as they get released. 
  • Educate employees on cybersecurity – Even advanced cyber threats still often rely on the most basic methods to infiltrate a target in the first instance, such as phishing emails and social engineering. By conducting regular training sessions and educating employees to identify and avoid such methods, organisations of all shapes and sizes can save themselves the huge headache caused by a successful cyber attack.

The Ryuk ransomware presents a very real threat to organisations around the world, particularly those across the healthcare and social services sector, many of whom are particularly vulnerable at the moment. Fortunately, there’s a range of effective steps that can be taken to ramp up protection against it, but the emphasis is on individual organisations to ensure they’ve assessed their existing protection, identified vulnerabilities and implemented the right fixes before it’s too late.


 

Tim Bandos

Tim Bandos, CISSP, CISA, CEH is Vice President of Cybersecurity at Digital Guardian and an expert in incident response and threat hunting. He has over 15 years of experience in the cybersecurity world and has a wealth of practical knowledge gained from tracking and hunting advanced threats that targeted stealing highly sensitive data. A majority of his career was spent working at a Fortune 100 company where he built an Incident Response organisation and he now runs Digital Guardian’s global Security Operation Center for Managed Detection & Response.

Data Centre Demand Growth Continues to Surge

Brad Legge • 02nd October 2025

The proliferation of digital technologies has thrust data centres into the spotlight as linchpins of modern business infrastructure. From cloud computing to artificial intelligence (AI), these facilities support critical operations across industries. The growing interest in generative artificial intelligence (AI) has triggered a race to develop technology, driving demand for high-density data centres and significantly...

5 Signs Your ERP System is Holding You Back

Adam Palmer • 11th September 2025

Is your ERP helping you move forward — or slowing you down? For a modern business, an ERP system should be a powerful enabler. One that drives agility, delivers real-time insights, and helps drive strategic growth — not something teams feel the need to work around. Yet too often, legacy ERP systems quietly drag down...

Why Wind River is serious about moving from VMware

Paul Miller • 09th September 2025

For IT departments with limited manpower and budgets, improving the efficiency of operational management of distributed IT infrastructure is a pressing issue. Organizations burdened with licensing costs, such as the VMware issue, will want to start optimizing costs and IT resources immediately. We interviewed a vendor that is working on this trend using open technology....

TPIs are the Future of Energy Solutions

David Sheldrake SVP POWWR • 19th June 2025

The energy industry is undergoing a transformation, and Third-Party Intermediaries (TPIs), those brokers and consultants who help businesses procure energy, are at the centre of it. With growing complexity, increasing regulation, and evolving customer expectations, the role of TPIs is shifting from price-focused brokers to strategic energy advisors. While renewable energy adoption continues to reshape...

Quick Commerce and the Retail Media Revolution

Sue Azari • 11th June 2025

Quick commerce has transformed the way consumers shop, redefining convenience with near-instant delivery of groceries, meals, and household essentials. However, beyond its impact on logistics and e-commerce, quick commerce is now emerging as a major force in digital advertising. As consumer behaviours shift toward on-demand purchases, these platforms are leveraging their vast first-party data and...