RYUK Ransomware Continues to Attack U.S. Businesses 23 Jul 2019 G’ SECURE LABS security@gsecurelabs.com
1
www.gsecurelabs.com
www.gsecurelabs.com
Ransomware has always given sudden quake by attacking the data of many businesses. According to Robinson & Cole from Lexology report, FBI recently flashes that RYUK ransomware is hitting more than 100 U.S. companies. It is predicted that RYUK will leave the damage on companies like logistics, technology, small municipalities and government agencies.� On May 18th, 2019 Monster Cloud’s CEO Zohar Pinhasi on WPTV said that RYUK is the new ransomware taking down businesses and government agencies. Ryuk, which started affecting companies in August 2018, is different from many other ransomware families, not because of its capabilities, but because of the novel way it infects systems.
Image Credit: csoonline.com RYYK was first seen in August 2018 and at that time at least three organizations were hit with Ryuk infections landing the attackers about $640,000 in ransom for their efforts. Researchers at checkpoint conducted deep analysis of this threat, and one of their findings was that Ryuk shares many similarities with another ransomware family Hermes. Inside of both Ryuk and Hermes, there are numerous instances of similar or identical code segments.
2
www.gsecurelabs.com
According to Flash given by FBI, when RYUK ransomware enters in your system, it deletes all files related to intrusion so it is impossible to identify the infection vector. It is able to steal credentials and brute forced Remote Desktop Protocols (RDPs) to gain access. After the attacker has gained access, more network exploitation tools can be downloaded on the victim’s system. Once RYUK gets executed, it establishes persistence in the registry, injects into running processes, looks for network connected file systems, and starts encrypting files. The FBI is looking for certain symptoms that includes information such as
Recovered executable file Copies of the “readme” file—DO NOT REMOVE the file or decryption may not be possible Live memory (RAM) capture Images of infected systems Malware samples Log files E-mail addresses of the attackers A copy of the ransom note Ransom amount and whether or not the ransom was paid Bitcoin wallets used by the attackers Bitcoin wallets used to pay the ransom Names of any other malware identified on your system Copies of any communications with attackers
We at G’SecureLabs have capabilities to save you from becoming a victim. Our managed detection and response (MDR) solutions have the ability to detect and prevent ransomware like RYUK through behavioural patterns shown by ransomware. MDR ensures that RYUK gets killed in very early stages of execution. This is possible with our cybersecurity professionals using machine learning (ML), IOA against these types of malware family. If you are a victim of a cyber-attack or ransomware, contact G’Securelabs at security@gsecurelabs.com Industries migrate to the new age of digital transformation.
3
www.gsecurelabs.com
Global HQ Maria Montessorilaan 5, 2719 DB Zoetermeer, The Netherlands
India Headquarters
Pune Office
B/81, Corporate House, Judges Bunglow Road, Bodakdev, Ahmedabad - 380054. India.
103, Pride House, 1st Floor, S. No. 108/7, Pune University Road, Pune- 411016, India.
Phone : +91 79 2685 2554 / 55 / 56
E-mail : hello@gsecurelabs.com www.gsecurelabs.com
Confidentiality Clause: This document and any files with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. 4 not the intended recipient, please destroy all copies of the document. Any unauthorized review, use, disclosure, www.gsecurelabs.com If you are dissemination, forwarding, printing or copying of this document or any action taken in reliance on this document is strictly prohibited and may be unlawful. Copyright Š Gateway Group