Ryuk Ransomware in 2019: How Targeted Attacks Changed the Ransomware Playbook

The ransomware story of 2019 is Ryuk — but understanding why requires understanding how fundamentally the ransomware model changed between 2017 and 2019. The WannaCry attack of 2017 was mass-scale and indiscriminate: it infected every vulnerable system it could reach and demanded $300 per device. Ryuk takes the opposite approach. It selects specific targets, spends weeks or months mapping the victim's network, disables backup systems before detonating, and then demands ransoms measured in hundreds of thousands or millions of dollars. The City of New Orleans paid $7 million in recovery costs. Universal Health Services spent $67 million recovering from a Ryuk attack. Several small and mid-size businesses were quietly hit for $200,000–$500,000 in demands that never made news.

How Ryuk Actually Works: The Three-Stage Attack Chain

Stage 1: Initial Access via TrickBot or Emotet

Ryuk rarely gains initial access directly. It is almost always preceded by TrickBot or Emotet — banking trojans delivered via phishing email that establish a persistent foothold in the victim environment. The initial infection may go undetected for weeks or months while the attackers observe network activity, harvest credentials, and identify valuable systems and backup infrastructure.

Stage 2: Lateral Movement and Privilege Escalation

Once inside, the threat actor (or the automated components of the malware) uses harvested credentials and tools like Mimikatz to escalate privileges, gain domain administrator access, and map the target network. They specifically identify and target: domain controllers, backup servers and NAS devices, financial systems, and any system containing data that would be most painful to lose.

Stage 3: Payload Detonation

Only after the attacker has achieved maximum reach — and has typically destroyed or encrypted backup systems to maximize the victim's desperation — does Ryuk encrypt the target environment. This sequencing is what makes Ryuk so much more damaging than earlier ransomware: by the time the ransom note appears, there may be no clean backup to restore from.

What Small Businesses Can Do Against Ryuk-Style Attacks

The Ryuk attack chain has multiple points of intervention. You do not have to stop the attack at every stage — you just need to stop it at one.

• Email security with behavioral analysis: Emotet and TrickBot are almost always delivered via phishing email. Advanced email security that analyzes sending patterns and URL reputation (not just content) blocks a significant percentage of initial access attempts.
• Endpoint Detection and Response (EDR): Legacy antivirus does not detect TrickBot or Ryuk because the signature changes with each variant. EDR detects behavior — the lateral movement, the credential dumping, the backup deletion — regardless of whether the specific malware is recognized.
• Privilege separation: If domain administrator credentials are only used on dedicated admin workstations (not general-purpose computers), the lateral movement phase of Ryuk is significantly more difficult and time-consuming.
• Immutable offsite backup: The most important control against Ryuk specifically is backup infrastructure that the ransomware cannot reach or delete. Cloud backup with immutable storage (where previous versions cannot be overwritten or deleted) ensures that even if Ryuk destroys your local backups, a clean recovery point exists.
• Network segmentation: If Ryuk cannot spread freely from an infected workstation to the domain controller and backup server, the blast radius of an infection is contained.

If You Are Hit: The First 4 Hours Matter Most

• Isolate infected systems immediately — disconnect from network but do not power off (forensic evidence is preserved in memory)
• Contact your managed IT provider or incident response team before contacting law enforcement — sequence matters
• Do not pay ransom without consulting legal counsel and a breach coach — payment may trigger OFAC sanctions compliance issues if the attacker is on a sanctions list
• Notify your cyber liability insurance carrier immediately — many policies require prompt notification and have breach response resources included
• Preserve evidence — do not wipe systems until forensic imaging is complete