Malware Spotlight: Ryuk Ransomware

This week, the Ryuk ransomware was used in two high profile campaigns targeting a media distribution company and a cloud hosting provider. The ransomware, first detailed by Check Point in August 2018, is being deployed to target institutions that have operational infrastructure as the core of its business model rather than information. Targeted attacks in this manner are following the successful SamSam ransomware model, which focuses on high value targets over wide distribution against less important assets.

Recommendations

Ryuk requires manual interaction for deployment on the system. The hackers using the ransomware must have extensive network knowledge before deployment and persistence. Because of this unique deployment method for ransomware we recommend:

• In the ZeroFOX platform, enabling the Cyber Attack Chatter Rule, implementing a custom rule to monitor for any company-specific leaked technical information, adding unique domains as Independent Search Terms under relevant entities, and adding verified accounts that you would like to monitor for mentions related to cyber reconnaissance;
• Keeping your security systems up to date with the latest detections;
• Maintaining secure backups of all business critical information; and
• Creating robust network segmentation to prevent easy movement of hackers between business units.

Details

Between December 30th and January 2nd, hackers using the Ryuk ransomware targeted Tribune Publishing - responsible for the printing and distribution of newspapers from San Diego to Baltimore - and Data Resolution, a cloud hosting provider. In both cases, a hacker deployed the ransomware on key resources in an attempt to maximize the damage to the companies’ operations as leverage for a sizable ransom payment.

Researchers at Check Point first detailed the Ryuk malware in August 2018. It shares technical similarities to the HERMES ransomware that was deployed against the Far Eastern International Bank (FEIB) in Taiwan as a diversion from a SWIFT heist in October 2017. While HERMES was deployed explicitly as a way to cover up other hacking activities , Ryuk has consistently been deployed in small, targeted intrusions with the goal of obtaining large ransom payments. Despite being a relatively simple piece of ransomware, it is engineered specifically for manual hacking campaigns that require significant in-network operations before successful deployment. The way the malware executes its encryption makes large-scale automated deployment almost impossible without a reconfiguration of its encryption.

Ryuk Hashes

c0202cf6aeab8437c638533d14563d35
d348f536e214a47655af387408b4fca5
958c594909933d4c82e93c22850194aa
86c314bc2dc37ba84f7364acd5108c2b
29340643ca2e6677c19e1d3bf351d654
cb0c1248d3899358a375888bb4e8f3fe
1354ac0d5be0c8d03f4e3aba78d2223e