Examining the Ryuk Ransomware

This Zscaler ThreatLabz report analyzes Ryuk ransomware: its distribution as a payload delivered by Emotet and TrickBot, OS-aware dropper behavior, persistence via Run registry key, process injection and termination of security/database services, deletion of shadow copies and backups via batch commands, and file encryption using per-file AES-256 with RSA-wrapped AES keys and a HERMES marker. The report notes Ryuk’s enterprise targeting and high ransom demands, describes ransom note behavior and dropped files (Public and UNIQUE_ID_DO_NOT_REMOVE), and includes MD5 indicators for observed samples.