Ryuk
Overview
Ryuk is a ransomware designed to target enterprise environments that, per MITRE ATT&CK, has been used in attacks since at least 2018 and shares code similarities with Hermes ransomware. It was frequently deployed as a final stage after access gained through TrickBot/Emotet infections and manual network reconnaissance, and is associated with high-ransom attacks on organizations including healthcare.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1566.001 T1486 T1490 T1059.003
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
- T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_RYUK {
meta:
description = "Detects Ryuk (ransomware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "ryuk" ascii wide nocase
$s2 = "ryuk" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Ryuk Activity
id: 399fb7d8c0de170b91f2018e19580023
status: experimental
description: Detects generic indicators of the ryuk malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*ryuk*"
- "*ryuk*"
condition: selection
level: mediumReferences & External Analysis
- MITRE ATT&CK: Ryuk (S0446)
- CISA Advisory
- Search "ryuk" on VirusTotal (External Analysis)
North American Authority Advisory (CISA / NIST)
The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: https://www.cisa.gov/news-events/alerts/2020/10/28/ransomware-activity-targeting-healthcare-and-public-health-sector
Frequently Asked Questions
What is Ryuk?
A targeted ransomware aimed at enterprise environments, used in attacks since at least 2018.
What is Ryuk related to?
MITRE notes it shares code similarities with Hermes ransomware.
How did Ryuk attacks usually start?
Frequently through prior TrickBot/Emotet infections that gave attackers a foothold to spread and deploy the ransomware.
Who was commonly targeted by Ryuk?
Enterprises and public-sector organizations, including healthcare, where downtime pressure could push victims to pay large ransoms.
Is paying the Ryuk ransom advisable?
Security guidance generally discourages paying ransoms. Restore from clean, tested backups and engage professional incident response instead.
How can organizations defend against Ryuk?
Block the precursor infections (phishing, TrickBot/Emotet), segment networks, limit privileged access, and maintain tested offline backups.
Where is the authoritative reference?
MITRE ATT&CK's Ryuk entry (S0446), linked on this page.
How do I remove the Ryuk Ransomware from Windows?
Manual removal of Ryuk is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Ryuk a virus or a Ransomware?
Ryuk is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Ryuk typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Ryuk infection?
Symptoms of Ryuk can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: ransomware)
Explore other malware families in the same category:
Protect Your Network Against Ransomwares
Want to prevent Ryuk and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/ryuk.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.