Rewterz Threat Alert – Ryuk Ransomware – IOC’s

Severity

High

Analysis Summary

Many ransomware families have changed their tactics and victim-targeting in recent years. Rather than indiscriminate attacks against anyone they’re able to infect, they have moved to a process called “big game hunting”. The motivation underlying this change of tactics is to increase the potential payout by targeting an organization rather than an individual. The adversary performs extensive reconnaissance on the target to determine what they may be able to pay. Rather than small ransom demands in thousands of dollars, by targeting businesses, they are aiming for payouts in the hundreds of thousands to millions of dollars.

One malware family in particular, Ryuk, has been attributed to the GRIM SPIDER threat actor group. This group has been operating the Ryuk ransomware since August of 2018. In recent months, a staged attack dubbed “triple threat” has emerged with the initial access to the network achieved by the Emotet malware family. Once initial access is achieved, the next stage, TrickBot, delivered inside the target organization. TrickBot has capabilities to steal credentials and to move laterally within the organization’s network. The third stage of the attack is to execute Ryuk ransomware on as many workstations and servers as possible via the lateral movement of TrickBot.

Impact

File encryption

Indicators of Compromise

MD5

c8325c660ea72a8eb5281898f7a87f34

SHA-256

18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1

SHA1

dd318ffdd4b1081733dccf95cddb4e000814e005

Remediation

• Block all threat indicators at your respective controls.
• always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.