Categories: MalwareRansomware

NCSC Issued an Emergency Alert for Ryuk Ransomware that Actively Attacks on Global Organizations

National Cyber Security Centre (NCSC) from the UK issued an alert for Ryuk ransomware attack that is actively targeting global organization associated with Emotet and TrickBot malware.

Researcher uncovered this ongoing Ryuk ransomware infection identified in the various organization network along with Emotet and TrickBot infection.

Ryuk Ransomware initially uncovered in August 2018 since then it infects and compromise various organization and steals millions of dollars from affected victims.

Emotet is one of the notorious malware family that infects various victims around the world and is used as a dropper for initial stage infection by other Trojans.

Trickbot is a banking malware which steals login credentials from applications. Since it was discovered long back ago, the threat actors continuously adding new capabilities to the malware.

Ryuk Ransomware using TrickBot and Emotet malware in its attack chain targeting large organizations for a high-ransom return and the Ryuk believed to be operated by GRIM SPIDER, a sophisticated hacking group.

Ryuk Ransomware infection Functionality

Ryuk ransomware using Emotet for the initial stage of infection and check the victim’s machine, whether it vulnerable to infection or not.

At the same time, Trickbot subsequently deploys additional post-exploitation tools to enable their operations, including powerful
Mimikatz and PowerShell Empire modules.

Post exploitation modules are used for credential harvesting, remotely monitoring of the victim’s workstation to infect a further system in the same network.

Machines infected with Emotet periodically check for modules from a command and control server (C2). These modules are typically DLLs or EXEs which are loaded on an infected system for extending capabilities.

All the non-executable file will be encrypted at the end of the infection process and displaying the ransomware notes with the demand of ransom amount in bitcoin.

“Ryuk is a persistent infection. The malware’s installer will attempt to stop certain antimalware software and install the appropriate version of Ryuk depending on a system’s architecture.”

According to NCSC, The Ryuk ransomware itself does not contain the ability to move laterally within a network, hence the reliance on access via a primary infection, but it does, however, have the ability to enumerate network shares and encrypt those it can access. This, coupled with the ransomware’s use of anti-forensic recovery, a technique to make recovering from backups difficult.

You can read more about the indicators of compromise and NCSC advisory Notes Here.

Read: Ransomware Attack Response and Mitigation Checklist

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Massive Ryuk Ransomware Attack on Entire Computers of Jackson County, Georgia – $400,000 Ransom Paid

A Scary Evolution & Alliance of TrickBot, Emotet and Ryuk Ransomware Attack

Ryuk Ransomware Attack on various Enterprise Network Around the World & Earned $640,000

FIN6 Hackers Group Targeting Enterprise Network to Deploy LockerGoga and Ryuk Ransomware

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago