What is Ryuk Ransomware?

Ryuk Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Large organizations; targeted human-operated attacks

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · CISA
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · CISA · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2018-08 discovered Ryuk observed in targeted attacks
2020-10 updated FBI/CISA technical advisory released

Quick Answer

Operators move laterally after initial access (often Emotet/TrickBot), then deploy Ryuk to encrypt domain controllers and critical servers.

Definition

Ryuk is a targeted human-operated ransomware family deployed after network compromise, historically associated with TrickBot and Emotet delivery.

Overview

Ryuk is a targeted human-operated ransomware family deployed after network compromise, historically associated with TrickBot and Emotet delivery.

Behavior

Hands-on-keyboard attacks
Encrypts network shares and domain controllers
Delivered via Emotet/TrickBot

First Seen

2018-08

Target

Large organizations; targeted human-operated attacks

Techniques: T1486, T1078, T1490
Campaigns: n/a
Related CVEs: CVE-2019-1040

Malware Intelligence

Family: Ryuk Ransomware

Aliases: Ryuk

Techniques: T1486, T1078, T1490

Targets: Large organizations; targeted human-operated attacks

Behavior:

Hands-on-keyboard attacks
Encrypts network shares and domain controllers
Delivered via Emotet/TrickBot

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Ryuk Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Ryuk Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.