{"id":11343,"date":"2019-01-23T11:05:31","date_gmt":"2019-01-23T00:05:31","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=11343"},"modified":"2019-01-23T11:05:31","modified_gmt":"2019-01-23T00:05:31","slug":"ransomware-ryuk-steals-4-million","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/ransomware-ryuk-steals-4-million","title":{"rendered":"New Ransomware “Ryuk” Steals $4 Mil from Big Fish"},"content":{"rendered":"

A new ransomware is out in the wild, and in an unusual move, it’s being picky with its targets. Unlike most ransomware strains, it’s attacking only targets with cash to spare, instead of indiscriminately spreading to all targets.<\/p>\n

But the cyber-crim’s tactics seem to have worked, netting almost $4 million since August. The ransomware is known as Ryuk – potentially named after a “grim reaper<\/a>” in a famous Japanese anime.<\/p>\n

This reaping ransomware infects large enterprises days, weeks, or even years after they were initially infected by a separate malware. This malware in most cases is a powerful trogan known as Trickbot.<\/p>\n

But small organizations who have been hit by Trickbot don’t get a visit from Ryuk. Instead, Ryuk engages in big game hunting. Perhaps the second-most unusual thing about Ryuk is the unusually long “dwell time” – the period between the initial infection and the ransomware demand.<\/p>\n

Why is this the case? It is believed this delay allows attackers to conduct valuable reconnaissance of the enterprise network, and hit the critical systems once they have the best avenue to infect them.<\/p>\n

CrowdStrike researcher Alexander Hanel wrote<\/a>:<\/p>\n

“Some of TrickBot\u2019s modules (such as pwgrab) could aid in recovering the credentials needed to compromise environments\u2014the SOCKS module in particular has been observed tunneling PowerShell Empire traffic to perform reconnaissance and lateral movement. Through CrowdStrike IR engagements, GRIM SPIDER has been observed performing the following events on the victim\u2019s network, with the end goal of pushing out the Ryuk binary:<\/em><\/p>\n