Many ransomware families have changed their tactics and victim-targeting in recent years. Rather than indiscriminate attacks against anyone they’re able to infect, they have moved to a process called “big game hunting”. The motivation underlying this change of tactics is to increase the potential payout by targeting an organization rather than an individual. The adversary performs extensive reconnaissance on the target to determine what they may be able to pay. Rather than small ransom demands in thousands of dollars, by targeting businesses, they are aiming for payouts in the hundreds of thousands to millions of dollars.
One malware family in particular, Ryuk, has been attributed to the GRIM SPIDER threat actor group. This group has been operating the Ryuk ransomware since August of 2018. In recent months, a staged attack dubbed “triple threat” has emerged with the initial access to the network achieved by the Emotet malware family. Once initial access is achieved, the next stage, TrickBot, delivered inside the target organization. TrickBot has capabilities to steal credentials and to move laterally within the organization’s network. The third stage of the attack is to execute Ryuk ransomware on as many workstations and servers as possible via the lateral movement of TrickBot.