{"id":60026,"date":"2019-01-14T11:29:08","date_gmt":"2019-01-14T17:29:08","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=60026"},"modified":"2019-01-14T11:31:52","modified_gmt":"2019-01-14T17:31:52","slug":"ryuk-targets-major-victims","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/ryuk-targets-major-victims\/","title":{"rendered":"Latest Ransomware Strain Targets Victims With Deepest Pockets"},"content":{"rendered":"

Ryuk, the latest ransomware variant that has taken the world by storm, has been targeting victims that promise big paydays.\u00a0 This is the same ransomware strain that hit Tribune Publishing in December of 2018,<\/a> leaving the distribution of multiple major newspapers, like the L.A. Times and Chicago Tribune, at a standstill.\u00a0 This is just one example of the 52 different confirmed Ryuk ransomware attacks<\/a> that have occurred since August 2018.\u00a0 Since the malicious variant has been in the wild, sources have tied $3.7 million in payouts to the Ryuk hackers.<\/p>\n

How is Ryuk Different?<\/h4>\n

First, it uses a highly targeted attack.\u00a0 It doesn’t send out a blanket email or exploit to the masses.\u00a0 Instead, it uses the banking Trojan, Trickbot to initiate its installation.\u00a0 Once Trickbot is installed, hackers will determine if the business is a good target for Ryuk.\u00a0 If so, the malware may lay dormant for up to a year before it initiates the malicious infection.\u00a0 To be clear, Ryuk only does a follow-up attack on larger targets, with a high likelihood of paying out the ransom demands.\u00a0 They consider optimal targets those with significant cash funds, that will not tolerate significant downtimes.<\/p>\n

Avoiding Trickbot Infection<\/h4>\n

Theoretically, if you can avoid Trickbot infection, you can avoid infection from Ryuk.<\/p>\n

Trickbot is an executable file.\u00a0 The most effective way to block malicious executable files is through the use of application whitelisting.\u00a0 By deploying a security solution that uses a whitelist as its primary method of malware detection, all unknown executable files will be blocked until proven secure.\u00a0 Meaning, even if the Trickbot coding is altered to change the executable itself, the file would still not run.\u00a0 The whitelist would block the new code from executing regardless of how it’s altered because the file will never be secure.<\/p>\n

The Ryuk Process<\/h4>\n

Just because Ryuk has previously used Trickbot as it’s initial means of integration into a PC and\/or server, doesn’t mean it always will.\u00a0 Therefore, users should be aware of how Ryuk initiates on its own.<\/p>\n

First, it involves the scripting engine PowerShell, followed by movement throughout the network through remote desktop protocol (RDP) ports.\u00a0PowerShell is not an executable file, meaning the security solution must include behavioral heuristics like malicious script blocking, in order to prevent the malicious use of PowerShell.<\/p>\n

Then, once a hacker exploits an RDP, they essentially have full access to the network to disable anything they’d like, as well as install whatever programs they so wish.\u00a0 To thwart RDP attacks, users should first disable any unused ports.\u00a0 By disabling the port from the network, hackers cannot execute brute force to gain access.\u00a0 For ports that must be connected, proper controls must be put in place to mitigate the risk of being exploited.\u00a0 For example, automatically locking the port for a predetermined amount of time if the incorrect credentials are not entered within a certain number of attempts.\u00a0 This control itself deters hackers from exploiting the system, because they will not take the time to wait for the time-out to be lifted, to make another handful of guesses.<\/p>\n

Recap<\/h4>\n

Ryuk ransomware has been infecting major businesses in the U.S., U.K., and Australia.\u00a0 This new variant has been known to target large profile targets with significant cash flow, and a limited ability and willingness to suffer significant downtime.\u00a0 By exploiting these two factors, Ryuk hackers experience an increased likelihood of getting paid to restore the infected files.\u00a0 This theory has been proven, as there have been 52 confirmed Ryuk attacks since August, with a total payout exceeding $3.7 million.<\/p>\n

The best way businesses can stay protected is to deploy a security solution<\/a> that has the following features:<\/p>\n