Ryuk works by encrypting files on infected systems. Unlike other types of ransomwares, Ryuk is human-operated, which makes it harder to detect autonomously. The cyberattackers who operate Ryuk interact in such a way that appears to be normal activity to basic security systems.
1. Ryuk deploys a phishing campaign. This may entail sending emails to users that contain malware via links and/or attachments. Victims may also discover and download malware from browsing the internet or while trying to connect to what looks to be a normal WiFi network.
2. When the victim clicks the link or opens the attachment, the payload (cargo of data used to maliciously interact with the victim’s computer) is deployed to the user’s computer. To an untrained eye, the payload downloads look very similar to usual windows files.
3. From here, computer malware designed to steal credentials,are deployed, often by a malware called Trickbot. In some cases, Ryuk is delivered via RDP or exploit, making it a fully human-operated attack. Ryuk can use lateral movement, meaning it can move from device to device within the network. As it steals credentials such as passwords and FTP credentials, its activity will not appear unusual to most network security monitors.
This process is carried out by human operators who covertly look for weaknesses to exploit, such as intentionally disabled virus protection, weak domain credentials, and/or non-randomized local admin passwords.
4. Once Ryuk bypasses network security, it launches its file encryption, which makes files inaccessible to users in the network. It also disables Windows restore, so that the victim cannot recover compromised files.
5. The encrypted files will keep their names but have a new extension, .RYK indicating that they have been encrypted by the Ryuk virus. The victim will see a text prompt asking for payment in exchange for decrypting the files.