Malware · critical

How to fix Ryuk Enterprise Ransomware

Error code: RYUK_RANSOMWARE

What this error means

Ryuk is a sophisticated ransomware variant targeting large enterprises and critical infrastructure. It is typically deployed manually by attackers after gaining access via phishing (often via Emotet or TrickBot) and lateral movement. It sometimes comes down to compromised Remote Desktop Protocol (RDP) entry points.

Updated

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 4 complete
01Enforce multi-factor authentication (MFA) on all remote logins
  1. Enforce multi-factor authentication (MFA) on all remote logins
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Disable RDP or secure it behind a VPN
  1. Disable RDP or secure it behind a VPN
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Deploy Endpoint Detection and Response (EDR) agents
  1. Deploy Endpoint Detection and Response (EDR) agents
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
04Reconstruct systems from isolated, immutable backups
  1. Reconstruct systems from isolated, immutable backups
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • Compromised Remote Desktop Protocol (RDP) entry points
  • Lateral movement of attackers using compromised admin credentials
  • Active botnet loaders like Emotet on the network