RANSOMWARE FAMILY
Ryuk
Ryuk is an older ransomware family, historically deployed as the final stage of a broader compromise that often began with TrickBot or Emotet malware. It's less common now than newer groups, but variants and copycats are still occasionally encountered.
What to look for
- Encrypted files commonly given a ".ryk" extension
- A ransom note typically named "RyukReadMe.txt" left in affected folders
- Signs of an earlier, separate malware infection (e.g. TrickBot or Emotet) preceding the encryption
- Attacks historically concentrated on larger organisations able to pay higher ransoms
Recovery approach
Because Ryuk usually follows an earlier infection, our assessment also looks for signs of that initial compromise — encryption is rarely the whole story.
OTHER FAMILIES WE SEE
Also covered
LockBit
One of the most widespread ransomware-as-a-service operations, active against organisations worldwide.
What to look for →Akira
A newer group known for exploiting VPN and remote-access weaknesses to gain entry.
What to look for →BlackCat / ALPHV
A Rust-based ransomware-as-a-service operation linked to a number of high-profile incidents.
What to look for →Qilin
A ransomware-as-a-service group behind a number of significant UK healthcare and services incidents.
What to look for →