New Ryuk Ransomware Sample Targets Webservers

Ryuk is a targeted ransomware family observed since 2018 that encrypts victims' files using AES-256 for file contents and RSA (2048/4096) to protect symmetric keys, demanding Bitcoin for decryption; infections commonly arise from spear-phishing, exploited public-facing apps, or via commodity malware loaders such as Emotet and TrickBot, and recent samples have targeted webservers and exhibit behaviors like printing multiple ransom notes. The report provides detection names, recommended defensive measures (patching, MFA, endpoint protection), MITRE technique mappings, and links to a full technical analysis and IOCs.