Ryuk ransomwareMalware
Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors.From MISP Galaxy
Last reported 26 days ago, by The Hacker News5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“The LNK file launches a VBScript that establishes persistence via a scheduled task, and triggers a PowerShell script to run every minute.”
- T1552.004Private Keys
“Hundreds of Leaked GitHub App Keys Still Active — A new analysis from GitGuardian has found that hundreds of GitHub App private keys leaked in public code still work.”
- T1036Masquerading
“…with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware call…”
- T1110.003Password Spraying
“The group, UNK_CondorFiltration, is using TeamFiltration, a tool to enumerate Entra ID accounts and launch password-spraying attacks.”
- T1195Supply Chain Compromise
“…allow a complete takeover of the target organization, or code execution on its internal infrastructure, with or without further supply-chain compromise."”
- T1213.005Messaging Applications
“Max analysis: Researchers at InterSecLab have published an in-depth analysis of Max, Russia's state-mandated messaging applications, and all the ways the app can spy on its users and what data it collects.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“In July 2026, Vardanyan pleaded guilty to conspiracy and computer fraud for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies across the U.S.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“…ber gets two years in prison: A US judge has sentenced an Armenian man to two years in prison for participating in attacks with the Ryuk ransomware.”
-
Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison“for his role in Ryuk ransomware attacks targeting American organizations between 2019 and 2020.”
-
Threat Advisory: Hackers Are Selling Access to MSPs“Something similar was observed regarding the Ryuk ransomware threat actor from September 2018 through the spring of 2019.”
-
The Brothers Grim“GrimAgent is a malware classified as a backdoor and that has been used as a prior stage to Ryuk ransomware.”
Indicators in its reports
named in the reports above- third-party[.]comin 2 reports
- fbijobs[.]govin 1 report
- 104.194.9[.]227in 1 report
- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- hxxp://ip-api[.]com/csv/?fields=query,countryCodein 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.