Initial infection is usually achieved through a weaponized Word document dropping Emotet. The operators behind Ryuk follow a tried-and-true plan to quickly penetrate a network, identify sensitive infrastructure, and move laterally.

Ryuk is typically not the first sign of trouble we see on a customer’s environment. In other words, they know Grandma isn’t going to buy BTC to get her pictures back, but a major corporation will.

Ryuk operators typically target enterprises that want to quickly resume normal business operations. Unfortunately, it’s fairly common these days to get a call from our IR partner Kroll as they take on a new customer who has spotted Ryuk in their environment. Wherever there is suffering you’ll find us there… Like Steve Martin, Chevy Chase, and Martin Short, our Three Amigos either ride into town on the same horse or aren’t far behind the other, with Ryuk usually bringing up the rear. The Red Canary CIRT sees Ryuk on a daily basis we’ve dubbed it one of the “Three Amigos,” along with Emotet and TrickBot. The organizations that experience the most damage are those without functional backups, incident response (IR) plans, and the means to detect and prevent the chain of behavior that leads to a Ryuk outbreak. Since then Red Canary has watched it quickly rise up the ranks, hitting the news on a near-daily basis as hospitals, local governments, businesses, and schools find themselves unprepared to deal with the sophisticated threat actors behind Ryuk. Ryuk started out as just another name in the vast ocean of ransomware that hit the internet like a tsunami a few years ago.

Three amigos script pdf