THREAT DOSSIER / 07

2018 · Enterprise-targeted ransomware

Ryuk

Often arrives after Emotet or TrickBot, surveys the network and attempts to remove backups before encrypting high-value systems.

01

Entry and propagation

A later-stage payload in a chain often beginning with a malicious email document and interactive network access.

02

Targets

High-value organizations, particularly companies, hospitals and the healthcare sector.

03

Impact

Broad encryption, service disruption and attempts to destroy recovery paths, with thousands of victims worldwide.

04

Defense

Protect email, monitor remote administration tools, isolate backups and test restoration regularly.