Increase in Ryuk ransomware attacks

Computers, networks and servers that have been infected with Emotet or Trickbot.

CERT NZ understands that there are three ways the majority of Ryuk ransomware attacks occur:

• Through a previous Emotet or Trickbot infection.
• Through email attachments that deploy Ryuk ransomware directly.
• Through RDP access, an attacker can install and execute Ryuk directly on the target machine or wider network.

Currently Ryuk is affecting international organisations in the health care sector, however anyone can be targeted by Ryuk, including individuals, businesses and large organisations.

The impacts of Ryuk are immediate. If you are affected:

You will not be able to access any of the files on your computer.

There will be a new file on your desktop titled ‘RyukReadMe.txt’ or similar, containing the ransom demands.

As there are multiple ways a Ryuk ransomware infection can occur, CERT NZ recommends you take the following measures:

• Make sure you have an anti-virus solution installed and kept up to date with detection signatures.
• Run an email-filtering solution to quarantine or reject suspicious attachments.
• Mandate the use of strong, unique passwords.
• Implement multi-factor authentication for account access where possible.
• Implement application whitelisting.
• Keep systems up-to-date with patches.
• Disable any unnecessary remote access capabilities (such as RDP).

Maintain an offline backup of your systems. 

If your system has been affected by the Ryuk, we recommend that you:

• Isolate the infected computer as soon as possible.
• Check for any other infected computers in your environment
• Re-image and patch the computer(s).
• Change all credentials, especially local admin and domain admin passwords.
• Notify everyone in your contact list and advise them not to open any attachments in emails that appear to have come from you.
• Review your mail and web filtering solutions.
• Review your antivirus solution.
• Enable PowerShell command logging to let you detect infected computers.
• Maintain an offline backup of your systems. 
• Network segregation.