The Ryuk Ransomware

This ANSSI report analyzes the Ryuk ransomware: its origins from Hermes, operational behaviour (file encryption, process/service termination, shadow copy deletion, Wake-on-LAN), common infection chains via Emotet/TrickBot/BazarLoader/BazarBackdoor/Buer, and associated cybercriminal groups (Wizard Spider, UNC1878, FIN6). It documents victimology (high-value 'big game' targets including US healthcare), provides a technical appendix on a 2021 self-propagating Ryuk variant (replication via SMB, scheduled tasks, sample hashes and mutex/propagation behavior), and offers mitigation/containment considerations.