Ryuk Ransomware Operators Employ Powershell Commands to Deploy Ransomware

Recently, cybersecurity experts have claimed that the operators of Ryuk Ransomware are targeting severe infrastructures to extort high ransom from their victims.

In 2018, the Ryuk ransomware was spotted for the first time, and the security researchers claim that the Ryuk procured and developed by its operators from the Hermes ransomware’s source code. 

As last year one of the largest health care organizations that has more than 90,000 employees, 400 hospitals, behavioral health centers, outpatient clinics in the U.S. and U.K. have been attacked by the operators of Ryuk Ransomware.

By force, the organization had to covey all their patients to other hospitals and health centers, as the attackers managed to gain access to their internal IT network and shut down all the internal computer systems of this organization in the US.

However, in the victim list of Ryuk ransomware, there are not only health organizations, even there are other infrastructures as well, and here they are:-

• Several oil and gas companies.
• A U.S. agency.
• A large engineering and construction services firm.
• City and county government.
• A financial software provider.
• A food and drink manufacturer.
• A newspaper.

But, later, the FBI publicly issued a warning about the Ryuk ransomware operators in June 2020, in which they claimed that the operators of Ryuk ransomware were also targeting educational institutes like K-12 institutes.

New tactics

As initial droppers, the operators of Ryuk ransomware have used the following malware:-

• Emotet
• TrickBot

But, they have now adopted new methods and tactics, “PowerShell commands” by encoding this, they do the following things:-

• Download the first payload.
• Disable security tools.
• Stop data backups.
• Scan the network.

Apart from these things, to deploy the ransomware on the infected system, they also exploit the Windows Management Instrumentation (WMIC) and BitsAdmin. 

The operators of Ryuk ransomware designed this new strategy form to empower the ransomware to remain hidden for a longer time on the infected networks without any detection.

Hits the Government Systems

By using the new strategy form and tools, the operators of Ryuk ransomware have also targeted the government systems, and during their attack, they managed to encrypt near about 2,000 internal systems and critical services.

While the experts explain that to execute this attack the operators of Ryuk have first gain access to an account of a domain administrator whose passwords were saved in a group policy.

Here, to scan the network and disable the security tools, the attackers used PowerShell; after that to copy the Ryuk to additional hosts with privileged account credentials they exploited the Windows Management Instrumentation (WMIC), PowerShell, and BitsAdmin.

Recommendations

Moreover, the U.S. federal government have suggested the companies few recommendations to combat these threats, and here they are mentioned below:-

• Perform regular backups.
• Risk analysis to identify all the potential issues.
• Proper staff training.
• Keep the systems updated with the latest updates and security patches.
• Application whitelisting to keep track of all the approved applications.
• Incident response to identifying and eliminate cyberattacks.
• Business Continuity.
• Penetration Testing.

Cybersecurity analysts have ensured that by following the above-mentioned recommendations the companies and organizations will be able to protect their users from cyber attacks like this.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.