Published: 8/27/2026
Written By: Lizzie Danielson
Ryuk is a high-stakes malicious software (malware) used to target large organizations for massive ransoms. Operators of ransomware tend to target healthcare organizations, schools, and private businesses. These organizations can’t afford downtime and are often willing to pay millions of dollars in recovery costs and Bitcoin ransoms. But even when companies choose not to pay the ransom, the costs remain high.
While there isn’t a foolproof way to avoid ransomware, this guide provides a practical Ryuk ransomware analysis to improve your cybersecurity posture. You’ll learn how to spot the threat early and stop the attack before ransomware disrupts your systems.
Ryuk is an infamous type of ransomware known for big game hunting. Since its initial discovery in 2018, experts have investigated several sources of the malware and now believe Russian language group Wizard Spider created it. Instead of using a quick, automated attack, these threat actors often spend days or weeks inside a compromised network. During this time, they perform recon, steal credentials, and identify the most critical files to guarantee a high ransom payout.
Off-the-shelf (commodity) ransomware casts a wide net and spreads via automated methods like phishing or malicious downloads. Threat actors use it to capture as many unsuspecting victims as possible to get many smaller ransom payouts. Ryuk, on the other hand, is a bespoke human-operated threat used exclusively for big game hunting to secure the largest ransom possible. The threat actors often use Trickbot or Emotet malware to gain access, and then manually compromise networks to identify critical assets.
Ryuk enables a lucrative attack for the hackers behind it, and it leads to big losses in downtime and ransoms for the organizations affected. Examples include:
Threat actors leveraging Ryuk usually deploy ransomware expertly and take their time after entering a system. They know that remaining embedded longer increases the damage they can inflict on their intended victims. However, spending long periods as an unauthorized guest in a system carries extra risks, as it raises the probability of being spotted. Organizations can use this window to block the threat before final deployment.
Ryuk threat actors often gain initial access via social engineering tactics like spear-phishing emails containing malicious attachments that drop malware like Emotet or Trickbot to establish a foothold. The attackers can then use tools like AdFind to query the Active Directory to locate valuable systems to target.
After the initial infection, threat actors often use tools like Cobalt Strike or Remote Desktop Protocol (RDP) to move laterally through the system. They can also use malware like Mimikatz to steal credentials and escalate privileges with the goal of compromising a target. At this point, threat actors can then spread an executable file (.exe) or payload to every endpoint in the organization.
Before the final attack, threat actors must disable defenses. They achieve this by killing security processes—such as EDR and antivirus agents—and disabling logging wherever possible. They also delete previous versions (shadow copies) using the vssadmin command-line utility and stop backup services. Finally, they encrypt production files—and, where possible, delete or encrypt accessible backups—so that restoring without paying becomes slow, costly, or impossible.
In the final stage, threat actors use the command-line tool PsExec or the Group Policy Object (GPO) directory to push the Ryuk payload across the domain. The malicious attack uses Advanced Encryption Standard (AES) and RSA encryption to lock files, requiring a secure key exchange. In many campaigns, encrypted files receive a new extension (commonly `.ryk`), and a text ransom note is dropped in each directory.
Our SOC analysts have encountered Ryuk on numerous occasions and now spot these signals before deployment. Security teams can use these indicators to speed up cybersecurity detection and block the attack before it escalates by identifying:
Traditional antivirus focuses on known malicious binaries. Ryuk operators, however, lean heavily on stolen credentials, RDP, and admin tools (PsExec, PowerShell, `icacls`, `vssadmin`). That means a lot of their activity looks like legitimate admin work until very late in the attack—often when encryption has already started.
Consequently, the best window for stopping this malicious attack is as early as possible. Ideally, your team should act while threat actors are still completing initial access and recon.
In the hours before the UHS Ryuk ransomware deployment, employees saw threat actors disabling antivirus software and accessing hard drives. Yet, the cybersecurity team did not act quickly enough to stop deployment.
Huntress Managed EDR is designed to detect and respond to Ryuk-style behaviors early—reconnaissance, lateral movement, backup tampering—so your team has a chance to contain the intrusion before widespread encryption.
Our human-led SOC, supported by automation and AI-driven detections, provides 24/7 monitoring and fast response, with mean time to respond (MTTR) measured in minutes for most escalated incidents.
By catching human-operated ransomware in its early stages, Huntress can help reduce the likelihood and potential impact of Ryuk-class incidents that have cost large organizations tens of millions of dollars.
Ransomware is a type of malware that cuts off your access to computers, systems, or networks. Watch the video from our Security Operations Center (SOC) for a breakdown of the ransomware attack path, so you can spot it early, shut it down, and steer clear of hacker paydays.
By the time you see the ransom note, the attack's been underway for hours, sometimes days. The encryption is the last step, not the first. If you only react when files lock up, you've already lost the part that mattered.
Many documented Ryuk intrusions have taken several days between initial compromise and mass encryption, with some campaigns operating for weeks. More recently, responders have seen Ryuk operators complete an entire attack—from initial access to full domain encryption—in as little as three hours.
Ryuk threat actors often manually disable cybersecurity controls early on in the attack. Consequently, no matter how effective the antivirus tool is, it can’t successfully spot unauthorized access while it’s off. However, some cybersecurity tools may spot the early attempts in time, such as flagging the initial malspam email.
Early indicators include:
