{"id":2291,"date":"2020-11-03T10:26:44","date_gmt":"2020-11-03T15:26:44","guid":{"rendered":"https:\/\/lg-staging.lougcloud.com\/?p=2291"},"modified":"2021-04-07T10:34:58","modified_gmt":"2021-04-07T15:34:58","slug":"what-is-ryuk-ransomware","status":"publish","type":"post","link":"https:\/\/lg-staging.lougcloud.com\/?p=2291","title":{"rendered":"What is Ryuk Ransomware?"},"content":{"rendered":"\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-85bp3-f856194ef33e7bc72ec0d3bf98278fce\">\n.flex_column.av-85bp3-f856194ef33e7bc72ec0d3bf98278fce{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-85bp3-f856194ef33e7bc72ec0d3bf98278fce av_one_full  avia-builder-el-0  el_before_av_section  avia-builder-el-no-sibling  first flex_column_div av-zero-column-padding  '     ><p><br \/>\n<section  class='av_textblock_section av-k0pon615-83a3f74a3a12ae3df6b12e1982bff3e8 '  ><div class='avia_textblock' ><h1>What is Ryuk Ransomware?<\/h1>\n<\/div><\/section><br \/>\n<section  class='av_textblock_section av-k0pop9td-34c3529061cd7bb9ffd7b4d3c815c3f0 '  ><div class='avia_textblock' ><p>Last week, we told you that Federal agencies issued an unprecedented (if that word doesn\u2019t describe 2020 I don\u2019t know what does) warning against \u201can increased and imminent <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa20-302a\" target=\"_blank\" rel=\"noopener noreferrer\">cybercrime threat to U.S. hospitals and healthcare providers<\/a>.\u201d The advisory, which comes from the Cybersecurity Infrastructure and Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS), describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health (HPH) Sector to infect systems with ransomware, notably <a href=\"https:\/\/news.sophos.com\/en-us\/2020\/10\/14\/inside-a-new-ryuk-ransomware-attack\/\" target=\"_blank\" rel=\"noopener noreferrer\">Ryuk and Conti<\/a>, for financial gain.<\/p>\n<p style=\"text-align: center;\">Lots of acronyms, but bear with us.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-2295 size-full\" src=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner.png\" alt=\"\" width=\"1500\" height=\"500\" srcset=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner.png 1500w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner-300x100.png 300w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner-1030x343.png 1030w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner-768x256.png 768w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware-banner-705x235.png 705w\" sizes=\"auto, (max-width: 1500px) 100vw, 1500px\" \/><\/p>\n<p>The Ryuk ransomware, operated by the TrickBot gang, was first spotted in August of 2018, but gained notoriety in 2019 once they began demanding multi-million-dollar ransoms from hospitals, local governments, and privately owned companies. Once the COVID-19 pandemic began, security experts noticed an increase in the number of high-value targets with the new stealthy <a href=\"https:\/\/news.sophos.com\/en-us\/2020\/10\/28\/hacks-for-sale-inside-the-buer-loader-malware-as-a-service\/\" target=\"_blank\" rel=\"noopener noreferrer\">BazarLoader<\/a> trojan before deploying the Ryuk ransomware. In fact, the operators of the ransomware pulled in over $61 million just in the US, according to figures from the Federal Bureau of Investigation. And that\u2019s just what was reported\u2014other estimates place Ryuk\u2019s take in 2019 in the hundreds of millions of dollars.<\/p>\n<h2>What makes the Ryuk attacks so notable?<\/h2>\n<p>According to the security experts who investigated a simulated attack, the speed in which the attacks can move from initial compromise to ransomware deployment is what makes this attack so dangerous. Within three and a half hours of a target opening a phishing email attachment, attackers were already conducting network reconnaissance. Within a day, they had gained access to a domain controller, and were in the early stages of an attempt to deploy ransomware.<\/p>\n<h2>What should you do if you experience a Ryuk attack?<\/h2>\n<p>If you are currently under attack, we strongly suggest you consider the <a href=\"https:\/\/sophos.com\/rapidresponse\" target=\"_blank\" rel=\"noopener noreferrer\">Sophos Rapid Response<\/a> solution. Because Louisville Geek is a certified Sophos partner, we can offer immediate assistance (even if you are not currently using Sophos). We have expert responders waiting to assist 24\/7 and we can have you fully onboarded in just a few hours. In fact, most customers are triaged in as little as 48 hours. If you are not a current customer of Louisville Geek, please <a href=\"https:\/\/lg-staging.lougcloud.com\/contact-us\/\" target=\"_blank\" rel=\"noopener\">contact us<\/a>. If you are a customer of Louisville Geek, please <a href=\"https:\/\/lg-staging.lougcloud.com\/support-center\/submit-service-ticket\/\" target=\"_blank\" rel=\"noopener\">submit a support ticket<\/a>.<\/p>\n<\/div><\/section><\/p><\/div><\/div><\/div><\/div><!-- close content main div --><\/div><\/div><div id='newsletter-cta'  class='avia-section av-k94bv4z5-3db5045821716543f466fd2ed6fe087e main_color avia-section-default avia-no-border-styling  avia-builder-el-4  el_after_av_one_full  avia-builder-el-last  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-2291'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-51vv-890cb9339298166528b66afbca7f3287\">\n.flex_column.av-51vv-890cb9339298166528b66afbca7f3287{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-51vv-890cb9339298166528b66afbca7f3287 av_one_half  avia-builder-el-5  el_before_av_one_half  avia-builder-el-first  first flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-k91ny805-e4fa07328a97eaf5a443b98b19009ade '  ><div class='avia_textblock' ><p>Louisville Geek provides comprehensive managed IT services for a diverse range of businesses and non-profit organizations. We are passionate about IT and love what we do!<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-2sej-3ae0b85a4ea0cf26f8956379e2e0883d\">\n.flex_column.av-2sej-3ae0b85a4ea0cf26f8956379e2e0883d{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-2sej-3ae0b85a4ea0cf26f8956379e2e0883d av_one_half  avia-builder-el-7  el_after_av_one_half  avia-builder-el-last  flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-k94busar-1ebe35827b8056452803c9570dc5b3a4 '  ><div class='avia_textblock' ><h3>Stay updated by signing up for our newsletter<\/h3>\n<\/div><\/section><br \/>\n<\/p><\/div>\n<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Ryuk ransomware, operated by the TrickBot gang, was first spotted in August of 2018, but gained notoriety in 2019 once they began demanding multi-million-dollar ransoms from hospitals, local governments, and privately owned companies. <\/p>\n","protected":false},"author":1,"featured_media":2294,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-2291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What is Ryuk Ransomware? - Louisville Geek<\/title>\n<meta name=\"description\" content=\"Louisville Geek is a certified Sophos partner and can offer immediate assistance. Most customers are triaged in 48 hours.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Ryuk Ransomware? - Louisville Geek\" \/>\n<meta property=\"og:description\" content=\"Louisville Geek is a certified Sophos partner and can offer immediate assistance. Most customers are triaged in 48 hours.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/lg-staging.lougcloud.com\/?p=2291\" \/>\n<meta property=\"og:site_name\" content=\"Louisville Geek\" \/>\n<meta property=\"article:published_time\" content=\"2020-11-03T15:26:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-07T15:34:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"864\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"lg_admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"lg_admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is Ryuk Ransomware? - Louisville Geek","description":"Louisville Geek is a certified Sophos partner and can offer immediate assistance. Most customers are triaged in 48 hours.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"What is Ryuk Ransomware? - Louisville Geek","og_description":"Louisville Geek is a certified Sophos partner and can offer immediate assistance. Most customers are triaged in 48 hours.","og_url":"https:\/\/lg-staging.lougcloud.com\/?p=2291","og_site_name":"Louisville Geek","article_published_time":"2020-11-03T15:26:44+00:00","article_modified_time":"2021-04-07T15:34:58+00:00","og_image":[{"width":1000,"height":864,"url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png","type":"image\/png"}],"author":"lg_admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"lg_admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#article","isPartOf":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291"},"author":{"name":"lg_admin","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/person\/3be0d57bc8c8a3746bb75ce4d733211c"},"headline":"What is Ryuk Ransomware?","datePublished":"2020-11-03T15:26:44+00:00","dateModified":"2021-04-07T15:34:58+00:00","mainEntityOfPage":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291"},"wordCount":907,"publisher":{"@id":"https:\/\/lg-staging.lougcloud.com\/#organization"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#primaryimage"},"thumbnailUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png","articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291","url":"https:\/\/lg-staging.lougcloud.com\/?p=2291","name":"What is Ryuk Ransomware? - Louisville Geek","isPartOf":{"@id":"https:\/\/lg-staging.lougcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#primaryimage"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#primaryimage"},"thumbnailUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png","datePublished":"2020-11-03T15:26:44+00:00","dateModified":"2021-04-07T15:34:58+00:00","description":"Louisville Geek is a certified Sophos partner and can offer immediate assistance. Most customers are triaged in 48 hours.","breadcrumb":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/lg-staging.lougcloud.com\/?p=2291"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#primaryimage","url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png","contentUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2020\/11\/Ryuk-Ransomware.png","width":1000,"height":864,"caption":"Ryuk Ransomware"},{"@type":"BreadcrumbList","@id":"https:\/\/lg-staging.lougcloud.com\/?p=2291#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/lg-staging.lougcloud.com\/"},{"@type":"ListItem","position":2,"name":"What is Ryuk Ransomware?"}]},{"@type":"WebSite","@id":"https:\/\/lg-staging.lougcloud.com\/#website","url":"https:\/\/lg-staging.lougcloud.com\/","name":"Louisville Geek","description":"Empowering Local Businesses and National Enterprises with Comprehensive IT Services","publisher":{"@id":"https:\/\/lg-staging.lougcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/lg-staging.lougcloud.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/lg-staging.lougcloud.com\/#organization","name":"Louisville Geek","url":"https:\/\/lg-staging.lougcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2019\/10\/lougeek_full_logo-black-1.png","contentUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2019\/10\/lougeek_full_logo-black-1.png","width":1671,"height":506,"caption":"Louisville Geek"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/person\/3be0d57bc8c8a3746bb75ce4d733211c","name":"lg_admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","caption":"lg_admin"},"url":"https:\/\/lg-staging.lougcloud.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/2291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2291"}],"version-history":[{"count":6,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/2291\/revisions"}],"predecessor-version":[{"id":2300,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/2291\/revisions\/2300"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/media\/2294"}],"wp:attachment":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}