# Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution Questioned

> Between August and December 2018, Ryuk ransomware was deployed against enterprises through an Emotet -> Trickbot -> Ryuk chain, with Ryuk pushed interactively (Empire, RDP, PsExec) onto selected high-value Trickbot victims. Kryptos Logic found little evidence for North Korean involvement despite Ryuk's code lineage to Hermes; CrowdStrike attributes Ryuk to the Russia-based GRIM/WIZARD SPIDER criminal group.

- **Published:** 2026-10-17T19:44:26Z
- **Last reviewed:** 2026-10-17T19:44:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3834
- **ID:** TL-2026-3834
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** GRIM SPIDER (Russia)
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ryuk was first observed in August 2018 (Check Point, 2018-08-20) and shares substantial code with Hermes ransomware, previously linked to the Lazarus group through an October 2017 SWIFT compromise at Far Eastern International Bank in Taiwan. Check Point documented identical encryption logic, marker generation/verification and process whitelisting between the two families, and noted that Hermes source code could have been reused by other actors or that the same actor is involved.

Kryptos Logic (2019-01-10) analyzed telemetry from the late-2018 attacks, including the October 2018 compromise of Onslow Water Authority, and described an infection chain in which Emotet infections deliver Trickbot, and Trickbot-infected hosts are then selectively escalated to Ryuk. Emotet periodically fetches modules (DLLs/EXEs) from its C2. Ryuk is not delivered by a standard Trickbot infection; instead it is deployed interactively, via the Empire framework, after operators have scouted and compromised a high-value target. Emotet infections were observed lingering for weeks before any Ryuk deployment, giving defenders a detection window. The article argues the evidence for North Korean involvement is weak and characterizes the activity as annoyingly-timed criminal attacks around the holidays; McAfee noted Ryuk source code had been available on underground forums for some time.

CrowdStrike (January 2019) attributes Ryuk to GRIM SPIDER (a Wizard Spider subgroup, the Trickbot operators) with medium-high confidence of Russia-based operation. Operators used obfuscated PowerShell connecting to a remote IP, PowerShell Empire installed as a service, RDP for lateral movement and PsExec to distribute Ryuk binaries. Ryuk injects into remote processes (VirtualAlloc, WriteProcessMemory, CreateRemoteThread) that do not run as NT AUTHORITY, encrypts with RSA-2048 and AES-256, appends the .RYK extension and drops RyukReadMe.txt. Batch files (kill.bat, windows.bat) stop 180+ services and 40+ processes (AV, database, backup, document editing software), delete shadow copies with vssadmin and delete backup files (.VHD, .bak, .wbcat). Persistence via the HKCU Run key value 'svchos' was reported by Check Point. Russian-language indicators supporting a criminal origin include a language check that prevents execution on Russian, Ukrainian or Belarusian hosts and Hermes being advertised on exploit.in. By January 2019, Ryuk had received 705.80 BTC across 52 transactions (about $3.7M); demands ranged from 1.7 to 99 BTC.

No CVEs, network IOCs (IPs/domains) or product versions are given in the cited sources, so none are recorded. CVSS is not applicable. This is a historical (2018-2019) campaign; severity is an analyst assessment.

## MITRE ATT&CK

- T1566 Phishing
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [North Korean APT(?) and recent Ryuk Ransomware attacks](https://www.kryptoslogic.com/blog/2019/01/north-korean-apt-and-recent-ryuk-ransomware-attacks/)
- [Check Point Research: Ryuk Ransomware - Targeted campaign break](https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/)
- [CrowdStrike: Big Game Hunting with Ryuk - Another Lucrative Targeted Ransomware](https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
- [TechTarget: Ryuk ransomware poses growing threat to enterprises](https://www.techtarget.com/searchsecurity/news/252455919/Ryuk-ransomware-poses-growing-threat-to-enterprises)
- [SC Media: Ryuk ransomware linked to Emotet and Trickbot trojans](https://www.scmagazine.com/news/ryuk-ransomware-linked-to-emotet-and-trickbot-trojans-suspicions-shift-to-cybercriminal-group)
- [Threatpost: Ryuk ransomware earnings and Trickbot](https://threatpost.com/ryuk-earnings-trickbot/140823)
- [Dark Reading: Ryuk Ransomware Origin Remains a Mystery](https://darkreading.com/application-security/ryuk-ransomware-origin-remains-a-mystery)
- [HHS: Ryuk update](https://www.hhs.gov/sites/default/files/ryuk-update.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3834