The Rise of Ryuk: Defending against a deadly new ransomware
Tim Bandos, CISO at Digital Guardian, looks at the rise of a new kind of ransomware and how best to counter its threat
The explosive growth of Ryuk ransomware has resulted in a massive 40% surge in the total number of ransomware attacks reported in Q3 2020 compared to the same period in 2019, taking the global total to over 200 million. While Ryuk ransomware isn’t totally new (having first appeared in 2018), the past twelve months has seen its popularity soar among cybercriminals.
The latest figures show Ryuk detections have risen from just 5,123 in Q3 2019 to over 67 million in Q3 2020 – equating to roughly a third of all ransomware attacks carried out in the quarter. So, what is Ryuk ransomware and how are criminals using it to target organisations, particularly in the healthcare sector?
What is Ryuk?
Ryuk is a highly sophisticated type of ransomware that’s being used to target organisations all over the world, locking them out of their computer networks and files until a ransom is paid. Once deployed, Ryuk encrypts all target files using a strong encryption based on AES-256 except those with the extensions dll, lnk, hrmlog, ini and exe. It also skips files stored in the Windows System32, Chrome, Mozilla, Internet Explorer and Recycle Bin directories. These exclusion rules are presumably intended to preserve system stability, enabling victims to access and use a browser to make ransom payments.
Like many ransomware programs, Ryuk also attempts to delete volume shadow copies in order to prevent victims from recovering their data through alternative means.
Read more: What security risks are associated with USB media?
When the victim has been infected, the perpetrators set ransom demands according to perceived ability to pay. According to researchers, the average ransom collected is around $750,000 (paid in Bitcoin), but the highest known payment to date is believed to be an eye-watering $34 million, paid by an unknown company in exchange for the decryption key.
The Russian group behind the attacks is known for using highly effective manual hacking techniques and open-source tools to move laterally inside compromised networks. Doing so helps them gain access to as many administrative areas as possible, as well as erase/cover their tracks before detonating the ransomware, with devastating results.
Who’s being targeted?
Data shows a wide range of sectors are being targeted, but one of the primary targets appears to be healthcare and social services providers, many of whom are particularly vulnerable at the moment due to the ongoing Coronavirus pandemic. This is because hospitals and healthcare facilities often have a wealth of legacy network infrastructure that’s inadequately protected from cyber attacks of this nature. When combined with the chaos and stretched resources caused by the pandemic, they become the perfect victims.
In the last few months, attacks have disrupted hospitals across the world with deadly consequences. In September, an attack disabled computer systems at Düsseldorf University Hospital in Germany, leading to one patient dying as doctors tried to transfer her out of the facility. Ryuk is also believed to be behind the recent ransomware attack on Universal Health Services (UHS), which runs approximately 400 hospitals and care centres across the US and UK, making it one of the largest medical cyberattacks in US history.
What can organisations do to effectively protect themselves?
Fortunately, the cybersecurity industry has taken numerous steps to help organisations defend themselves against the rise of Ryuk. Many advanced threat protection (ATP) providers such as Digital Guardian have already released free policy packs that enable customers to update their existing security tools and solutions to rapidly detect signature network activities that indicate a potential attack is in progress. These include the detection of mass file editing to known Ryuk ransomware extensions, deletion of volume shadow copies, and attempts to connect to known command and control infrastructure associated with the ransomware campaign. Elsewhere, organisations can implement the following basic steps to bolster their cybersecurity defences against threats like Ryuk:
- Maintain regular data backups – conducting regular backups of all key organisational data is one of the best ways to minimise disruption in the event of a successful breach. Storing these backups securely, away from the main network, will prevent them from being deleted or encrypted as part of an attack.
- Keep security patches up to date – as mentioned above, cybersecurity vendors are already well aware of Ryuk and the vast majority have updated their products and solutions to detect its signatures. However, these updates only come into effect when customers install the latest security patches on their networks. As such, it’s critical that such patches are installed as soon as they get released.
- Educate employees on cybersecurity – Even advanced cyber threats still often rely on the most basic methods to infiltrate a target in the first instance, such as phishing emails and social engineering. By conducting regular training sessions and educating employees to identify and avoid such methods, organisations of all shapes and sizes can save themselves the huge headache caused by a successful cyber attack.
The Ryuk ransomware presents a very real threat to organisations around the world, particularly those across the healthcare and social services sector, many of whom are particularly vulnerable at the moment. Fortunately, there’s a range of effective steps that can be taken to ramp up protection against it, but the emphasis is on individual organisations to ensure they’ve assessed their existing protection, identified vulnerabilities and implemented the right fixes before it’s too late.
