Threat reportRansomwareTL-2026-3834
Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution Questioned
Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North (TL-2026-3834), also tracked as Ryuk, is a high-severity ransomware operation, first published 2026-10-17. It is attributed to GRIM SPIDER (Russia) with medium confidence, affects Microsoft Windows (enterprise networks), maps to 13 MITRE ATT&CK techniques (T1003, T1021.001, T1055), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 2GRIM SPIDER
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3834
- Threat ID
- TL-2026-3834
- Also known as
- Ryuk, Emotet-Trickbot-Ryuk chain
- Severity
- HIGH
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- GRIM SPIDER, Periwinkle Tempest
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government administration, utilities, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North
Malware and tooling: Emotet - S0367, Hermes, Ryuk, Trickbot, Empire - S0363, PSEXEC, Trick Bot
How Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North works
Between August and December 2018, Ryuk ransomware was deployed against enterprises through an Emotet -> Trickbot -> Ryuk chain, with Ryuk pushed interactively (Empire, RDP, PsExec) onto selected high-value Trickbot victims. Kryptos Logic found little evidence for North Korean involvement despite Ryuk's code lineage to Hermes; CrowdStrike attributes Ryuk to the Russia-based GRIM/WIZARD SPIDER criminal group.
Ryuk was first observed in August 2018 (Check Point, 2018-08-20) and shares substantial code with Hermes ransomware, previously linked to the Lazarus group through an October 2017 SWIFT compromise at Far Eastern International Bank in Taiwan. Check Point documented identical encryption logic, marker generation/verification and process whitelisting between the two families, and noted that Hermes source code could have been reused by other actors or that the same actor is involved.
Kryptos Logic (2019-01-10) analyzed telemetry from the late-2018 attacks, including the October 2018 compromise of Onslow Water Authority, and described an infection chain in which Emotet infections deliver Trickbot, and Trickbot-infected hosts are then selectively escalated to Ryuk. Emotet periodically fetches modules (DLLs/EXEs) from its C2. Ryuk is not delivered by a standard Trickbot infection; instead it is deployed interactively, via the Empire framework, after operators have scouted and compromised a high-value target. Emotet infections were observed lingering for weeks before any Ryuk deployment, giving defenders a detection window. The article argues the evidence for North Korean involvement is weak and characterizes the activity as annoyingly-timed criminal attacks around the holidays; McAfee noted Ryuk source code had been available on underground forums for some time.
CrowdStrike (January 2019) attributes Ryuk to GRIM SPIDER (a Wizard Spider subgroup, the Trickbot operators) with medium-high confidence of Russia-based operation. Operators used obfuscated PowerShell connecting to a remote IP, PowerShell Empire installed as a service, RDP for lateral movement and PsExec to distribute Ryuk binaries. Ryuk injects into remote processes (VirtualAlloc, WriteProcessMemory, CreateRemoteThread) that do not run as NT AUTHORITY, encrypts with RSA-2048 and AES-256, appends the .RYK extension and drops RyukReadMe.txt. Batch files (kill.bat, windows.bat) stop 180+ services and 40+ processes (AV, database, backup, document editing software), delete shadow copies with vssadmin and delete backup files (.VHD, .bak, .wbcat). Persistence via the HKCU Run key value 'svchos' was reported by Check Point. Russian-language indicators supporting a criminal origin include a language check that prevents execution on Russian, Ukrainian or Belarusian hosts and Hermes being advertised on exploit.in. By January 2019, Ryuk had received 705.80 BTC across 52 transactions (about $3.7M); demands ranged from 1.7 to 99 BTC.
No CVEs, network IOCs (IPs/domains) or product versions are given in the cited sources, so none are recorded. CVSS is not applicable. This is a historical (2018-2019) campaign; severity is an analyst assessment.
MITRE ATT&CK techniques used in TL-2026-3834
Credential Access
Lateral Movement
T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer
Defense Evasion
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1569.002 Service Execution
Impact
T1489 Service Stop; T1490 Inhibit System Recovery
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Initial Access
defense-impairment
Affected products and versions in Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North
- Microsoft — Windows (enterprise networks)
Remediation for Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North
Immediate actions
- Hunt for Emotet and Trickbot infections; treat any Trickbot host as a potential precursor to Ryuk
- Investigate lingering Emotet infections, which preceded Ryuk deployment by weeks
- Alert on PowerShell Empire services, PsExec and RDP lateral movement from Trickbot-infected hosts
- Alert on vssadmin Delete Shadows / resize shadowstorage and kill.bat / windows.bat execution
Workarounds
- Block or filter malicious email attachments that deliver Emotet
- Restrict PowerShell execution and enable script block logging
Longer-term hardening
- Maintain offline, immutable backups that cannot be reached with domain credentials
- Restrict RDP and administrative share access and segment networks
- Deploy EDR with behavioral detection of process injection and mass file encryption
Timeline of Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North
- October 2017: Hermes ransomware variant used in the SWIFT compromise at Far Eastern International Bank (Taiwan), later linked to Lazarus; Ryuk shares code lineage with Hermes
- August 2018: WIZARD SPIDER (GRIM SPIDER) begins operating Ryuk; first Ryuk payments received
- Check Point publishes first Ryuk analysis, noting Hermes code similarity and over $640,000 in ransom payments
- October 2018: Onslow Water Authority compromised by Emotet and Ryuk
- Ryuk payload sha256 795db7bd... compiled, one of the recent samples around the holiday attacks
- January 2019: CrowdStrike attributes Ryuk to GRIM SPIDER; Ryuk had received 705.80 BTC across 52 transactions (about $3.7M USD)
- Kryptos Logic publishes analysis of the Emotet -> Trickbot -> Ryuk chain and finds little evidence of North Korean involvement
Sources cited for Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North
- North Korean APT(?) and recent Ryuk Ransomware attacks
- Check Point Research: Ryuk Ransomware - Targeted campaign break
- CrowdStrike: Big Game Hunting with Ryuk - Another Lucrative Targeted Ransomware
- TechTarget: Ryuk ransomware poses growing threat to enterprises
- SC Media: Ryuk ransomware linked to Emotet and Trickbot trojans
- Threatpost: Ryuk ransomware earnings and Trickbot
- Dark Reading: Ryuk Ransomware Origin Remains a Mystery
- HHS: Ryuk update
Detection coverage for TL-2026-3834
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3834 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.