A Deep Dive into the Ryuk Ransomware Attack Chain and Its Impact

This report provides a technical analysis of the Ryuk ransomware (attributed to Wizard Spider), mapping its attack chain to the MITRE ATT&CK framework. It explains initial access via phishing and secondary loaders (Emotet/TrickBot), discovery and credential theft techniques (adfind, nltest, systeminfo, Rubeus kerberoasting), privilege escalation and lateral movement (PowerView/PowerLine), defense-evasion steps (PowerShell policy changes, WMI queries), and impact actions (disabling backups, deleting shadow copies, AES/RSA encryption). The document also shows Picus simulation commands used to emulate Ryuk behaviors and validate defensive controls.