TechnologyProductsBlogResourcesCompanyFree Trial Darktrace Blog Recycling ransomware: The return of Ryuk Brianna Leddy, Director of Analysis | Thursday October 21, 2021 In the era of international-scale cyber-warfare, focus has started to move away from small-time cyber thieves toward well-known, well-funded and sometimes government-backed cyber-crime organizations. Cyber-attacks sometimes work on discordant scales, however, and it doesn’t always take big budgets or key players for considerable damage to be dealt. Numerous stories detail how the criminal and the curious alike have single-handedly breached some of the most secure systems in the world. At the more amusing end, there’s the story of Kristoffer von Hassel who discovered a novel exploit in Microsoft’s Xbox Live system at just five years old. And then of course there are those who hack their way right into promising security careers by breaching systems at major organizations. However, genuine damage has been done by individual threat actors as well. These might be criminals using second-hand offensive tools, buying botnet armies for as little as $10 on the Dark Web, or using ransomware files downloaded for free. But ultimately, even a single cyber-criminal can inflict crippling damage upon large organizations if they are given the opportunity. This is especially the case when the tools in their possession have been developed by some of the most notorious names in cyber-crime. Copycat criminals In early 2021, Darktrace detected a new instance of the once notorious Ryuk ransomware being launched against a business in the APAC region. The detection was intriguing. The developers of Ryuk, a prolific cyber-criminal organization given the name ‘Wizard Spider’, had long since abandoned it in favor of a successor called ‘Conti’. Wizard Spider have launched some of the largest cyber-attacks in recent history, allegedly with the support of the Russian government, and are under investigation by Interpol and the FBI. They are not known for using outdated tools. It soon became clear that this attack was not being launched by Wizard Spider at all, but by small-scale threat actors picking up the tools Wizard Spider left behind. And as the new attackers proved, these tools are still far from defunct. Ryuk ransomware: A city-stopper for sale Ryuk ransomware is commonly used to target large enterprise environments, even taking down entire city councils in some instances. Lake City, Florida and the City of Onkaparinga in South Australia are two of its known victims, along with numerous schools and hospitals across the US. Once active in a system, Ryuk uses a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files, disabling Windows’ system restore feature as it does so, and generally demands payment via Bitcoin in return for a private decryption key. Though Ryuk was not initially sold in the same manner as its predecessor, Hermes, on the Dark Web site ‘exploit[.]in’, it is now believed by some publications that the toolkit must be available somewhere for various threat actors to buy and tailor to their requirements. This explains its recurrence beyond Wizard Spider activities. New dog, old tricks Darktrace spotted the new instance of Ryuk during a trial with a real estate business in the APAC region. The first warning sign came when some basic .dat files were downloaded onto one of the business’ devices from an unknown Russian IP address. Darktrace immediately detected that this download was a likely breach and, had Antigena been set up in active mode, would have initiated a targeted response at this early stage. The .dat files on the infected device allowed the attackers to use RDP (Remote Desktop Protocol) to spread further into the business’ network. Two days after the initial compromise, the threat actor had gained administrative credentials through a bruteforce attack and could begin scanning the network further. Figure 1: Timeline of the attack The witching hour Just an hour after the attacker gained administrative credentials, at approximately 3:30am local time, ransomware files appeared in the business’ network. This timing was not accidental. The attackers knew that the security teams at the target business were home and asleep when the ransomware landed in the small hours of the morning, giving them plenty of time to conduct their attack. This is precisely the kind of simple tactic which can multiply the scale of an attack without using large budgets or complex toolsets. The Ryuk ransomware rapidly began encrypting corporate files during the night, and by the time the security team returned in the morning, all they could do was shut down the entire network and hope to limit the spread of Ryuk, if only to save a few final devices. The total attack time, from initial compromise to widespread data encryption, was just two and a half days. Whether due to understaffing or preoccupation, the security team did not find the time in that small window to respond to alerts, and, with Darktrace Antigena in passive mode, the attack was able to go ahead. This business’ need for Autonomous Response, which can protect against old and new attacks around the clock without the need for manual intervention, was painfully apparent. Autonomous Response: Stop Ryuk before Ryuk stops you Understanding Ryuk’s history and functionality does little good for organizations when it is still capable of eluding their defenses and catching security teams unawares. Darktrace’s Self-Learning AI is uniquely positioned to address these sophisticated threats, even as they evolve in the hands of different attackers and become unrecognizable to traditional rule-based security approaches. Utilizing 24/7 Autonomous Response to stop both new and old threats at machine speed gives security teams the best chance of leveling the playing field against attackers. With Darktrace Antigena, the size or status of the attacking organization and their toolset is irrelevant – any anomalous and threatening behavior will be neutralized quickly and accurately, before damage can be done. Thanks to Darktrace analyst Thomas Nommensen for his insights on the above threat find. Learn more about how Autonomous Response stops attacks in seconds Brianna Leddy Based in San Francisco, Brianna is Director of Analysis at Darktrace. She joined the analyst team in 2016 and has since advised a wide range of enterprise customers on advanced threat hunting and leveraging Self-Learning AI for detection and response. Brianna works closely with the Darktrace SOC team to proactively alert customers to emerging threats and investigate unusual behavior in enterprise environments. Brianna holds a Bachelor’s degree in Chemical Engineering from Carnegie Mellon University. Share on Facebook Tweet Share on LinkedIn Send email Related posts How Self-Learning AI protects McLaren Racing from supply chain attacks Tuesday November 16, 2021 GitLab vulnerability exploit detected by AI Monday November 8, 2021 Big game hunting: How Ryuk ransomware takes down its imposing targets Wednesday October 2, 2019 Recent posts The tech driving Arrow McLaren SP to the top Wednesday November 17, 2021 How Self-Learning AI protects McLaren Racing from supply chain attacks Tuesday November 16, 2021 Hacking season: Why Cyber Monday presents a cyber security nightmare Thursday November 11, 2021 GitLab vulnerability exploit detected by AI Monday November 8, 2021 Living off the Land: How hackers blend into your environment Thursday November 4, 2021 Recycling ransomware: The return of Ryuk Thursday October 21, 2021 Read more Technology Self-Learning AI Autonomous Response Intelligence Augmentation Products Enterprise Immune System Industrial Immune System Darktrace Antigena Cyber AI Analyst Darktrace for Cloud Darktrace for SaaS Darktrace for Email Darktrace for Endpoint Darktrace for Network Darktrace for OT Darktrace for Microsoft Darktrace for Ransomware Integrations Resources Blog Darktrace Events Industry Events On-Demand Events Industries Videos White Papers Data Sheets Case Studies Third-Party Reports Company Company Overview Investors In the News Press Releases Darktrace Community Darktrace Education Awards Partners Executive Team Subject Matter Experts Board of Directors Advisory Council Science and Technology Committee Careers Contact Legal Follow us on Twitter Follow us on LinkedIn +44 (0) 20 7930 1350 info@darktrace.com © 2021, Darktrace We use cookies to remember your preferences, serve embedded video and collect information about how visitors use our website. If you consent, please click the Accept cookies button. For more information, please read our Cookie Policy. Accept cookies No, thanks