Ryuk Demanded Millions From Companies

Most criminals are like fishermen throwing a wide net into the sea, hoping to catch anything at all. The people behind Ryuk did the opposite. They behaved like patient hunters tracking one very large animal. They picked a giant company, slipped quietly inside its walls, and then hid there. For days, sometimes for weeks, they walked the digital corridors of that building at night, learning where the doors were, where the keys hung, and where the treasure room sat. Nobody heard them. Nobody saw them. Then, on one chosen night, they struck every room at once — and by morning, an entire company could not open a single file.

That is what made Ryuk different from almost every ransomware before it, and it is why hospitals, newspaper groups and huge businesses learned to fear its name.

What Ryuk ransomware is and what it does

Ryuk is a type of ransomware, which means it is a criminal program built to lock a victim’s files and demand money for unlocking them. When Ryuk runs, it scrambles the data on a computer using strong encryption, a kind of mathematical padlock. Documents, photos, databases and records all turn into unreadable nonsense. Without the secret key, which only the criminals hold, the files cannot be opened again. A ransom note is left behind, explaining how the victim can pay, usually in Bitcoin, to buy the key back.

The name itself has an unusual story. Analysts who pulled the malware apart found the name Ryuk inside its code and notes. Ryuk is a character from Death Note, a famous Japanese comic and cartoon series, a supernatural being who drops a dangerous notebook into the human world and watches the chaos that follows. The criminals clearly liked the comparison: they, too, dropped something dangerous into the world of ordinary people and watched what happened next.

Ryuk first appeared in August 2018, and it spread fast through the criminal world because it worked. But the clever part was never only the padlock. The clever part was the patience. Ryuk was almost never the first thing to enter a company. It was the last thing — the final blow, delivered by hand, after human operators had prepared the ground. Understanding that chain is the real story of this malware.

How a Ryuk attack chain reaches a company

A Ryuk attack usually began with something painfully ordinary: an email. US agencies that tracked these attacks documented a pattern in which the first step was often a phishing message sitting in the inbox of a regular employee. It might look like an invoice, a shipping notice or a message from the office. Hidden inside it, or in an attachment the person was tricked into opening, sat an earlier piece of malware such as Emotet or TrickBot.

That first program was not the kidnapper. It was more like a scout who had picked the lock on the front door. Once inside one computer, it could steal passwords typed on that machine and help the criminals move deeper into the company’s network, from one connected machine to the next. Sometimes this quiet stage lasted for weeks. The criminals were in no hurry at all, because they were not after one small computer. They were mapping a giant.

When the operators finally understood the whole network, they did three cold, careful things. First, they explored until they could reach the central computers that hold a company’s most important data. Second, they switched off security tools that might spot the attack or stop it. Third — and this is what made Ryuk so cruel — they hunted down the backups and destroyed or disabled them. Backups are a victim’s spare key. Ryuk’s operators made sure there would be no spare key.

Only then, often in the middle of the night or on a weekend, did they release Ryuk itself across the network. Instead of one computer being locked, hundreds or thousands were locked in the same few hours. And because the target was a huge organisation that could not simply stop working, the ransom demand was sized for a giant. Reported demands for large victims ran into the millions of dollars.

Here is the part that matters for anyone reading this at home: the first link of that chain can reach an ordinary person very easily. A phishing email does not care whether it lands in the inbox of a hospital clerk or in your own inbox. The trick email, the fake invoice, the reused password — these are everyday things. Ryuk was the last link of a long chain, but the chain itself started at somebody’s ordinary desk.

The damage story behind Ryuk ransomware

The numbers tell part of the story. The US FBI and CISA, the country’s cybersecurity agency, attributed the Ryuk attacks to a cybercrime group tracked under the name Wizard Spider. In January 2021, the FBI reported that Ryuk’s operators had received more than $61 million in ransom payments during the period covered by its advisory. That figure only counts what investigators could trace. The true cost was far larger, because it ignores the hospitals that could not work properly, the staff paid to rebuild systems, and the business lost while computers sat dead.

Two famous cases show what a Ryuk night actually looked like. In 2020, Universal Health Services, a huge hospital company in the United States, was hit. Computer systems went down across hundreds of its hospital facilities, as staff suddenly lost the digital records and systems modern hospitals run on. Nurses and doctors had to fall back on paper and workarounds while the company fought to recover. It was widely reported as one of the largest medical cyberattacks in American history.

Two years earlier, in 2018, Tribune Publishing, a major American newspaper group, was attacked in a way that delayed the printing of its newspapers. Think about that for a moment: a program hiding inside computers was strong enough to slow down physical printing presses, trucks and morning deliveries of paper newspapers. Ryuk lived on screens, but its damage kept stepping out into the real world.

How to protect yourself from a Ryuk-style attack

You cannot stop a criminal group on another continent from trying. But you can break the first link of the chain, and that link is the one within your reach.

Treat every unexpected email like a possible trap door. The chain that ended with a locked hospital started with one believed message. If an email asks you to open an attachment, click a link or type a password, stop and check it through a different route. Call the sender on a number you already trust. A genuine invoice can wait ten minutes. A trap cannot survive ten minutes of questions.

Turn on two-factor sign-in everywhere it is offered. This adds a second check, usually a code sent to your phone, after your password. Stolen passwords were fuel for the criminals who moved through a network before releasing Ryuk. With a second factor switched on, a stolen password alone is not enough to open your account, and the scout program’s favourite trick fails.

Use a different password for every important account. The chain-spreading tools stolen passwords and tried them in new places. If your email password is also your bank password, one leak hands over everything. A password manager can remember strong, unique passwords so your brain does not have to.

Keep a backup that criminals cannot touch. Ryuk’s operators deliberately destroyed backups before striking, because a working backup means the victim can simply refuse to pay. Keep a copy of your important files on an external drive that you unplug after backing up, or in a separate cloud account. A backup that is disconnected cannot be encrypted by anything that infects your computer.

Update your devices and use built-in security tools. Updates close the holes that chain malware climbs through, and modern operating systems carry decent protection of their own. It costs nothing and runs quietly, which is exactly the sort of guard a patient hunter hates.

To me, the scariest part of Ryuk is not the encryption — it is the weeks of silence before it, while strangers quietly learned somebody’s whole workplace.

Common questions

What does the name Ryuk mean?

Ryuk is a character from Death Note, a well-known Japanese comic and cartoon series. Analysts found the name inside the malware’s code and its ransom notes, which is how the ransomware got its name in security reports.

Why did Ryuk ask for so much more money than other ransomware?

Because it was aimed by hand at very large organisations. The operators spent weeks inside a network, destroyed the backups, then encrypted everything at once, so they could demand a ransom sized for a giant — reported demands ran into the millions of dollars for big victims.

How much money did Ryuk’s operators make?

In January 2021, the FBI reported that the operators had received more than $61 million in ransom payments during the period its advisory covered. The total real-world damage, including recovery costs and lost work for victims, was much larger.

Who was behind Ryuk ransomware?

The US FBI and CISA attributed the attacks to a cybercrime group tracked under the name Wizard Spider. Law enforcement agencies around the world have continued to track the people and money connected to that group.

Can Ryuk attack my home computer?

The Ryuk program itself was aimed at big organisations, but the first steps of its attacks were ordinary tricks — phishing emails and stolen passwords — that are used against everyone. The habits that stop those tricks at home are the same ones that break the chain before it ever reaches a company.

Sources

• Wikipedia — Ryuk: https://en.wikipedia.org/wiki/Ryuk