Ryuk Ransomware: Ongoing Threat to Large Organizations

• •Ryuk ransomware targets large organizations, often in critical sectors like healthcare.
• •The malware employs advanced encryption techniques and disables backup services to maximize impact.
• •Ransom demands can reach millions, with a history of significant financial losses for victims.

Ryuk ransomware, attributed to the Russian group Wizard Spider, continues to target large organizations, particularly in sectors like healthcare and government. The malware is delivered through phishing attacks and often relies on other malware like Emotet or TrickBot for initial access. Once inside a network, Ryuk can disable critical services, encrypt files using AES-256 and RSA-4096 encryption, and demand ransoms that can reach millions of dollars. Notable past attacks include disruptions to Tribune Publishing and Jackson County, Georgia. Security professionals are urged to enhance their defenses against this persistent threat, which has resulted in significant financial losses for victims. The ransomware's ability to perform remote encryption and disable backup systems complicates recovery efforts. As of now, Ryuk remains a significant threat, with ongoing attacks reported.