What is Ryuk ransomware?

Ryuk is a targeted ransomware strain operated by the Wizard Spider threat group, active since August 2018. It pioneered the 'big game hunting' approach of targeting large organizations for maximum ransom payments, often demanding millions of dollars. Ryuk evolved into Conti ransomware and has caused over $150 million in damages.

Ryuk Ransomware

Ryuk Ransomware is a ransomware operation attributed to Wizard Spider / eCrime, active since 2018. Big game hunting ransomware from Wizard Spider. Key capabilities include: BazarLoader delivery, Conti successor, $150M+ in ransoms, hospital targeting.

Overview & Operations

Big game hunting ransomware from Wizard Spider. The group has been active since 2018 and operates as part of the broader ransomware-as-a-service ecosystem. Notable technical characteristics include: BazarLoader delivery, Conti successor, $150M+ in ransoms, hospital targeting.

Ransomware Threat

Ryuk Ransomware employs double extortion tactics — encrypting victim data while simultaneously exfiltrating sensitive information for leverage. Organizations that refuse to pay face public data exposure on the group's leak site.

Operator: Wizard Spider / eCrime
Active since: 2018
Tooling: BazarLoader delivery, Conti successor, $150M+ in ransoms, hospital targeting
Extortion model: Double extortion (encryption + data leak)

Tactics, Techniques & Procedures

Ryuk operators typically gain initial access through phishing, exploiting public-facing applications (VPN, RDP, Exchange), or purchasing access from initial access brokers (IABs). Post-compromise, they deploy Cobalt Strike or similar C2 frameworks for lateral movement before deploying the ransomware payload.

Initial access: Phishing, vulnerability exploitation, RDP brute force, IAB purchases T1566.001 T1190
Execution: PowerShell, WMI, PsExec for payload deployment T1059.001
Persistence: Scheduled tasks, service creation, registry modifications T1053.005
Defense evasion: Security tool tampering, Safe Mode exploitation, BYOVD T1562.001
Lateral movement: RDP, SMB, WMI, admin shares T1021.002
Exfiltration: Custom exfiltration tools, cloud storage, Rclone T1567
Impact: File encryption with custom encryptor T1486

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Initial Access	T1190 Exploit Public-Facing App	VPN/RDP/Exchange exploitation
Execution	T1059.001 PowerShell	Post-exploitation scripting
Persistence	T1053.005 Scheduled Task	Persistence mechanism
Defense Evasion	T1562.001 Disable Security Tools	EDR/AV tampering
Credential Access	T1003.001 LSASS Memory	Credential dumping
Lateral Movement	T1021.002 SMB/Admin Shares	Network propagation
Exfiltration	T1567 Exfil Over Web Service	Data theft before encryption
Impact	T1486 Data Encrypted for Impact	Ransomware deployment

Detection & Defense

Backup strategy: Maintain offline, immutable backups with tested restoration procedures
Network segmentation: Limit lateral movement paths between critical systems
EDR deployment: Behavioral detection for ransomware indicators (mass file modification, shadow copy deletion)
MFA enforcement: Protect RDP, VPN, and admin portals with phishing-resistant MFA
Patch management: Prioritize VPN, Exchange, and remote access vulnerabilities
Threat intelligence: Monitor for Ryuk IOCs and dark web activity

Protect Against Ryuk Ransomware

Mjolnir Security provides ransomware prevention, detection, and response services against Ryuk Ransomware and similar threats.

Ransomware DefenseIncident ResponseThreat HuntingMDR ServicesBackup AssessmentTabletop Exercises

Ransomware Readiness Assessment Evaluate your organization's resilience against Ryuk and similar ransomware operations with gap analysis and remediation recommendations.
Ransomware Incident Response Rapid containment, negotiation support, and forensic investigation when ransomware strikes.
24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: December 23, 2025