Ransomware Update: Surge in Ryuk Attacks

An advisory has been released by the UK National Cyber Security Center, concerning a new Ryuk ransomware campaign. Ryuk is a family of ransomware that was first observed in August 2018. It is generally linked with Emotet or Trickbot, but could also be dropped by other malware families. Ryuk has been used in a number of high-profile attacks against US government instituions in the last month, including the Georgia court system.

Recommendations

• Maintain and frequently update offline backups of all critical information.
• Ensure defensive systems are updated with the latest detection.
• Consider enabling the Cyber Chatter rule in order to monitor activity related to this malware family.

Details

The United Kingdom's National Cyber Security Center has released a new advisory on a recent spike in Ryuk ransomware activity. Ryuk is known for adjusting its ransom according to the victim's percieved ability to pay, and for its long waiting period between initial infection and actual encryption of an infected machine. Ryuk is often seen dropped by Emotet and Trickbot banking trojans, although it has also been observed to be dropped by other malware as well. Ryuk lacks the ability to move laterally within a network, however, it does have the ability to enumerate and encrypt accessible network shares, and uses a number of anti-analysis techniques.

Although Ryuk is not a new ransomware family, it has hit US news recently as it was utilized in an attack against the State of Georgia. Both the Judicial Council and the Administrative Office of the Courts. Ryuk was also used in three attacks against the State of Florida last month.

The following are indicators of compromise associated with this recent campaign:

Hashes: 3a1692a6d0f6881b45792dfc4649b166965744b3d387784494d67874cd5d379b b895399bdd8b07b14e1e613329b76911ebe37ab038e4b760f41e237f863b4964 fe55650d8b1b78d5cdb4ad94c0d7ba7052351630be9e8c273cc135ad3fa81a75 85e5aff9b169657ba912f4edc019e2d38dd3c3fb2be187309dd65d4ae8732529

IP Addresses: 200[.]107[.]59[.]130 5[.]196[.]154[.]93 94[.]103[.]94[.]154 186[.]42[.]186[.]202 177[.]52[.]79[.]29 187[.]8[.]169[.]10 187[.]65[.]49[.]88 200[.]83[.]49[.]141 200[.]35[.]56[.]81 177[.]183[.]194[.]194 200[.]110[.]72[.]134 186[.]248[.]163[.]198 191[.]241[.]233[.]195 187[.]95[.]32[.]18 187[.]95[.]123[.]179 177[.]52[.]28[.]238