The Demon Ryuk, Big-Game Hunter

Legend

Appearing in August 2018 and linked to the Wizard Spider group, it usually arrived after a TrickBot or BazarLoader infection and picked targets able to pay a lot. It hit hospitals, municipalities and newspapers, demanding ransoms in the millions. From 2021 its place was taken by Conti.

Exorcism

Cast it out by stopping its forerunners first: a stealer or loader on the network is the sign it is coming. Use MFA on remote access, fewer admin privileges and immutable backups.

Technical record

Circle: Circle III · Ransomware and extortion
First seen: 2018
Status: Dormant
Weapons (exploited CVEs): Saint Zerologon, Who Showed Up With Only Zeros

Big-game-hunting ransomware first seen in August 2018, operated by Wizard Spider and typically deployed after TrickBot or BazarLoader infections. It targeted hospitals, municipalities and newspapers and demanded large ransoms. It faded in 2021 as the operators moved to Conti.

Sources: attack.mitre.org · attack.mitre.org · cisa.gov · MITRE ATT&CK reference S0446