North Korea-linked Ryuk Ransomware used in a targeted campaign

Check Point reported that organizations worldwide have been targeted with the Ryuk ransomware that was developed by North Korea-linked threat actor.

Security experts from Check Point have uncovered a ransomware-based campaign aimed at organizations around the world conducted by North Korea-linked threat actor.

The campaign appears as targeted and well-planned, crooks targeted several enterprises and encrypted hundreds of PC, storage and data centers in each infected company.

Some organizations paid an exceptionally large ransom in order to retrieve the encrypted files, CheckPoint confirms that the ransom amount paid by the victims ranged between 15 BTC to 50 BTC.

At least three organizations in the United States and worldwide have been severely affected, the attackers are estimated to have already netted over $640,000 to date.

The malicious code used in the attack was tracked as Ryuk ransomware, it appears connected to Hermes malware that was associated with the notorious Lazarus APT group.

“Curiously, our research lead us to connect the nature of Ryuk’s campaign and some of its inner-workings to the HERMES ransomware, a malware commonly attributed to the notorious North Korean APT Lazarus Group, which was also used in massive targeted attacks.” reads the analysis published by Check Point.

“This leads us to believe that the current wave of targeted attacks using Ryuk may either be the work of the HERMES operators, the allegedly North Korean group, or the work of an actor who has obtained the HERMES source code.”

The HERMES ransomware was first spotted in October 2017 when it was involved in a targeted attack against the Far Eastern International Bank (FEIB) in Taiwan.

Of course, we cannot exclude that another attacker was in possession of the Hermes’ source code and used it to develop the Ryuk ransomware.

Experts highlighted that the encryption scheme of the Ryuk ransomware was built specifically for small-scale operations.

“Unlike the common ransomware, systematically distributed via massive spam campaigns and exploit kits, Ryuk is used exclusively for tailored attacks. In fact, its encryption scheme is intentionally built for small-scale operations, such that only crucial assets and resources are infected in each targeted network with its infection and distribution carried out manually by the attackers.” continues the report.

Experts found many similarities between the encryption logic implemented in the Ryuk’s code and the one used in the HERMES ransomware.

Continuing the analysis, the experts discovered that both ransomware uses a quite identical dropper.

When executed the Ryuk ransomware conducts a Sleep of several seconds, then it checks if it was executed with a specific argument and then kills more than 40 processes and over 180 services associated with to antivirus, database, backup and document editing software.

The ransomware destroys its encryption key and deletes shadow copies and various backup files from the disk in order to prevent victims from recovering their files.

It is interesting to note that almost all of the Ryuk ransomware samples analyzed by the experts were provided with a unique wallet. Once the victims have paid the ransom, the attackers divided the funds and transmitted them through multiple accounts.

“From the exploitation phase through to the encryption process and up to the ransom demand itself, the carefully operated Ryuk campaign is targeting enterprises that are capable of paying a lot of money in order to get back on track.” concludes CheckPoint.

“Both the nature of the attack and the malware’s own inner workings tie Ryuk to the HERMES ransomware and arouse curiosity regarding the identity of the group behind it and its connection to the Lazarus Group.” Check Point says.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Ryuk ransomware, North Korea)

[adrotate banner=”5″]

[adrotate banner=”13″]