RyukMalware
Ryuk is a ransomware which encrypts its victim's files and asks for a ransom via bitcoin to release the original files. It is has been observed being used to attack companies or professional environments. Cybersecurity experts figured out that Ryuk and Hermes ransomware shares pieces of codes.From MISP Galaxy
Last reported 13 days ago, by AhnLab ASEC11 reports
ATT&CK techniques
6 of 55 · each with the sentence it comes from- T1053.005Scheduled Task
“The LNK file launches a VBScript that establishes persistence via a scheduled task, and triggers a PowerShell script to run every minute.”
- T1005Data from Local System
“Data from Local System (T1005), Data from Network Shared Drive (T1039), Data Staged (T1074)”
- T1036Masquerading
“…with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware call…”
- T1078Valid Accounts
“Registry Run Keys / Startup Folder (T1060), Scheduled Task (T1053), Valid Accounts (T1078)”
- T1110.003Password Spraying
“The group, UNK_CondorFiltration, is using TeamFiltration, a tool to enumerate Entra ID accounts and launch password-spraying attacks.”
- T1133External Remote Services
“External Remote Services (T1133), Spearphishing Attachment (T1193), Spearphishing Link (T1192)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
September 2026 Dark Web Threat Actor Trend Report“…Stresser Oleksii-Lytvynenko Operation-PowerOFF Pepijn-van-der-Stap Poland PwnForums RaidForums RansomHouse Ransomware RBL-LEVIATHAN-GHOST Ryuk Sality Saudi-Arabia seizure Sentencing ShinyHunters source-code-leak supply-chain-attack T1ER0NE Taiwan TakeDown Telecommunications trans…”
-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“Armenian National Sentenced to 2 Years for Ryuk Ransomware Attacks — Karen Serobovich Vardanyan, 34, who was extradited from Ukraine to the U.S.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“Ryuk member gets two years in prison: A US judge has sentenced an Armenian man to two years in prison for participating in attacks with the Ryuk ransomware.”
-
Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison“Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S.”
-
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO“Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“Part of the analyzed activity in the ShadowSyndicate cluster can be attributed to Cl0p, ALPHV/BlackCat, Black Basta, Ryuk, and Malsmoke.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“Further research uncovered connections with various ransomware families (for example Trickbot, Nokoyawa, Royal, Ryuk, FIN7, ALPHV, and Cl0p).”
-
The Brothers Grim“The infamous ransomware gang Ryuk, which is responsible for many high-profile cyber heists (including the attack on the Baltimore County Public Schools system) followed suit.”
-
Discovering a Ransomware Remedy in the Wild“…e adjusted and fine-tuned to one’s needs, but the repository goes on to showcase how this can stop the infection of Emotet, RagnarLocker, Ryuk and more.”
-
What Is Human-Powered Threat Hunting?“Sometimes, it’s other well-known strains such as Trickbot or Dridex, other times it’s highly destructive ransomware like Ryuk.”
-
ATT&CKing ProLock Ransomware“QakBot is also known to be loaded by Emotet, a trojan notorious for its connection with Ryuk operators.”
Indicators in its reports
named in the reports above- third-party[.]comin 2 reports
- 0108656a3e1ade6ca4f21b084f5e1208in 1 report
- bea5e267f24d7da59f6821bffdbff293in 1 report
- 37.19.210[.]12in 1 report
- 146.70.117[.]239in 1 report
- 149.102.229[.]154in 1 report
- 104.164.55[.]46in 1 report
- 104.28.162[.]228in 1 report
- 104.28.163[.]162in 1 report
- 64.190.76[.]14in 1 report
- 192.42.116[.]50in 1 report
- 192.42.116[.]12in 1 report
- 192.42.116[.]56in 1 report
- 192.42.116[.]97in 1 report
- 192.42.116[.]52in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.