H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Ryuk

[Ryuk](https://attack.mitre.org/software/S0446) is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. [Ryuk](https://attack.mitre.org/software/S0446) shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Ryuk](https://attack.mitre.org/software/S0446) is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. [Ryuk](https://attack.mitre.org/software/S0446) shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)

Labels

malware
24 recorded

Relationships

uses
from FIN6
Group
uses
to Access Token Manipulation
Technique
uses
to Data Encrypted for Impact
Technique
uses
to Disable or Modify Tools
Technique
uses
to Domain Accounts
Technique
uses
to File and Directory Discovery
Technique
uses
to Inhibit System Recovery
Technique
uses
to Local Storage Discovery
Technique
uses
to Masquerading
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Native API
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Scheduled Task
Technique
uses
to Service Stop
Technique
uses
to SMB/Windows Admin Shares
Technique
uses
to System Language Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Traffic Signaling
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Permissions
Technique
uses
from Wizard Spider
Group
6 external

References

mitre-attack
S0446
open
Ryuk
—
Bleeping Computer - Ryuk WoL
https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
open
FireEye Ryuk and Trickbot January 2019
https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
open
CrowdStrike Ryuk January 2019
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
open
FireEye FIN6 Apr 2019
https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance