Ryuk Ransomware

Ryuk is a family of ransomware first identified in 2018 that targeted large organisations able to pay big ransoms, a tactic known as "big game hunting". Victims included hospitals, newspapers, city and county governments and manufacturers, mostly in the United States. Attackers usually gained access through earlier infections by other malware, often spread by phishing emails, then spent time moving through the network before encrypting files and deleting backups. Ransom notes demanded payment in bitcoin, and security researchers estimated that the operation collected very large sums. Ryuk was linked by researchers to a Russian-speaking criminal group often called Wizard Spider, and its activity declined around 2021 as the same circle shifted to the Conti ransomware. Its attacks on hospitals during the COVID-19 pandemic drew joint warnings from US agencies. Ryuk is often cited in debates on whether crypto payments should be restricted to curb ransomware.