Ryuk Ransomware Goes From Secret Weapon to Forum Merchandise
Born From Hermes, Raised by Professionals
Early reporting pinned Ryuk on North Korea because chunks of its code matched Hermes, a ransomware once pushed through a Lazarus-linked account. That theory faded as researchers mapped the operation. Check Point documented the Hermes code reuse in August 2018 and noted the payload looked commercially assembled rather than state-built. CrowdStrike tracks the crew as Wizard Spider, a Russia-based group better known for the TrickBot platform, while other vendors label the same operators Grim Spider or UNC1878 depending on which slice they saw. The through-line is a professional outfit running Ryuk the way a firm runs a product: recruiters, operators, negotiators, cashiers. That distinction matters. A state program chases strategy; a criminal firm chases margin. Ryuk's playbook, patience plus personalized extortion, was optimized for revenue per victim, and the numbers it produced rewrote what the ransomware market thought was possible.
How a Ryuk Ransomware Job Looked From the Inside
Most ryuk ransomware attacks began weeks before any file got scrambled. A phishing email carrying a booby-trapped invoice installed Emotet, a loader that vacuumed up mail credentials and passed the infected machine to partners. TrickBot came next, spreading through the network and hunting for domain admin access while its operators catalogued what the victim owned. Only after the groundwork hardened did the humans move in, typically late on a Friday or over a holiday weekend. Using legitimate admin tools and PsExec they pushed the Ryuk binary to servers and workstations at once, then stood back while whole file systems seized up within hours. On every encrypted host sat the ryuk ransomware note, a short text file often named RyukReadMe with an email address and a promise to prove decryption on a couple of sample files. Analysts nicknamed the whole pipeline Emotet TrickBot Ryuk because breaking any single link starved the operation.
Big-Game Hunting Paid Out in Bitcoin
The payoff math explains the patience. Where commodity lockers chased hundreds of dollars per machine, Ryuk demanded sums calibrated to the victim's balance sheet. Demands of $100,000 were routine, and several crossed into the millions when the target looked liquid. The ledger tells the scale. CipherTrace's August 2020 tracking put Ryuk's cumulative take near $150 million in Bitcoin, making it one of the most profitable strains then running. Hits kept landing in headlines too: Tribune Publishing newspapers missed print runs around Christmas 2018, and Universal Health Services, with roughly 400 facilities, watched its computers go dark in September 2020. Victims who wrote checks funded an expanding payroll. That revenue financed better loaders, smarter distribution and the professional polish that later defined Conti. In retrospect the ryuk malware did not just steal money; it proved a business case that a dozen successor brands raced to copy.
Then It Showed Up in the Classifieds
By the fall of 2022, researchers were flagging adverts on a dark web ransomware marketplace that offered Ryuk-branded packages to anyone with a wallet. The listings marked a quiet milestone: a flagship of the ransomware-as-a-service trade reduced to an off-the-shelf purchase, bundled with setup help and, in some offers, tutorial material on moving laterally once inside. The logic is simple once a tool's mystique outlives its edge. A name everyone fears still sells, even after the professionals have moved on. Buyers get a working, battle-tested payload for cheap; sellers monetize code that no longer anchors their own campaigns. Would-be customers browsing such listings also faced a second market in pre-hacked access. Brokers advertised corporate logins alongside the malware, so a single evening's shopping could theoretically yield both the tool and the target. If you want ryuk ransomware explained as an economics story, that shelf-space moment is where it ends.
Paying Up Rarely Fixed Anything
Ryuk's extortion pitch rested on a promise that payment buys recovery, and the record says otherwise. The operators' own decryptor was buggy: versions of it silently dropped the last byte of larger files, which corrupted documents and databases even when the key was right. Some victims who paid never received a working tool at all. Then there is the legal exposure. The U.S. Treasury's OFAC warned in October 2020 that ransom payments to sanctioned actors could violate regulations, and parts of the Wizard Spider ecosystem ended up on sanctions lists. A victim writing a check had no way to know whose wallet the money landed in. Emsisoft and other firms did publish fixes for a handful of flawed builds, so some unlucky files could be coaxed back without paying. Everyone else faced the same fork: restore from backups or start over. Organizations with tested, isolated backups shrugged off the ransom note entirely.
Where Ryuk Went and What Took Its Place
Ryuk did not get beaten by antivirus; it got squeezed by supply lines. The January 2021 Emotet takedown cut off the botnet that fed most of its infections, and reported Ryuk deployments thinned out through the middle of that year. The talent simply rebranded. Security teams tie the same operators to Conti, which carried the big-game torch through 2021 and into 2022, until leaked internal chats and bad publicity pushed the crew to retire that name. Members then dispersed into outfits like Black Basta and Karakurt, carrying the same craft of staged intrusion and negotiated extortion. So the forum adverts of late 2022 were less a comeback than a clearance sale. The original crew had better tools and newer names, which left the old Ryuk badge for whoever wanted to inherit its reputation along with the diminishing returns of a strain every defense already knew.
Signals That Would Have Caught It Early
The attack chain had a long fuse, and each stage made noise. Emotet or TrickBot detections were treated for years as commodity infections worth a routine cleanup; the Ryuk era proved they were actually the opening act of a tailored intrusion. Every loader alert deserved escalation, not just remediation. Identity signals mattered too. Unexpected authentication from service accounts, remote desktop logins at strange hours from foreign addresses, or a sudden sweep of discovery commands across hosts all preceded detonation. Endpoint tools flag mass encryption quickly, but the deletion of volume shadow copies is an earlier, sharper alarm. And because detonation typically hit on weekends, timing was itself a tell. Organizations that hardened the doorway, watched for precursor trojans, and kept clean offline copies of critical data usually met the Ryuk era with a shrug. Those controls still work on every successor wearing a different name.
Frequently asked questions
Who actually wrote Ryuk ransomware?
Attribution points to a Russian-speaking criminal crew tracked as Wizard Spider or UNC1878, the same operation behind TrickBot. An early theory blamed North Korea because Ryuk shared code with Hermes, but that line of thinking was dropped once the group's infrastructure, partnerships and profit motive became clear.
How much money did Ryuk operators make?
Blockchain analysis by CipherTrace put Ryuk's earnings near $150 million by mid-2020, with individual demands ranging from six figures into the millions. That haul made it the most profitable ransomware of its era and funded the infrastructure later used by successor brands like Conti.
Is Ryuk still being used in attacks?
Reported Ryuk incidents faded sharply after mid-2021 when its Emotet supply line collapsed and the operators shifted to newer brands. Copies and kits still circulate on forums, so repacked variants occasionally appear, but the original crew's campaigns under that name are long over.
Why would criminals sell a well-known ransomware?
Once a strain is thoroughly documented and every antivirus flags it, the brand has more value as merchandise than as a working tool. Selling kits converts a fading asset into quick crypto, and the buyers, often inexperienced, take on all the legal risk while the developers walk away paid.
Can Ryuk-encrypted files be recovered without paying?
Sometimes. Emsisoft published fixes for certain builds whose cryptography or decryptor had exploitable flaws, and backups remain the dependable route. Outside those narrow cases the encryption held, which is why incident responders focused on preventing detonation rather than promising recovery.