Ryuk Enterprise Ransomware

What is RYUK-RANSOMWARE?

Ryuk Enterprise Ransomware is a critical-severity malware/security issue. Ryuk is a sophisticated ransomware variant targeting large enterprises and critical infrastructure. It is typically deployed manually by attackers after gaining access via phishing (often via Emotet or TrickBot) and lateral movement. It sometimes comes down to compromised Remote Desktop Protocol (RDP) entry points. See the troubleshooting steps below for the fix.

Common Causes

• Compromised Remote Desktop Protocol (RDP) entry points
• Lateral movement of attackers using compromised admin credentials
• Active botnet loaders like Emotet on the network

Step-by-Step Fix Guide

• 1
  Enforce multi-factor authentication (MFA) on all remote logins

  "Enforce multi-factor authentication (MFA) on all remote logins" is worth trying when compromised Remote Desktop Protocol (RDP) entry points turns out to be the culprit.

• 2
  Disable RDP or secure it behind a VPN

  "Disable RDP or secure it behind a VPN" is the next step worth ruling out for RYUK-RANSOMWARE.

• 3
  Deploy Endpoint Detection and Response (EDR) agents

  "Deploy Endpoint Detection and Response (EDR) agents" is the next step worth ruling out for RYUK-RANSOMWARE.

• 4
  Reconstruct systems from isolated, immutable backups

  "Reconstruct systems from isolated, immutable backups" covers a less common but documented cause of RYUK-RANSOMWARE.

Commands & Diagnostics

Frequently Asked Questions