Over 400 United States Hospitals Effected by Ransomware

Ryuk does not appear on computers without Emotet, first compromising the victim computer.  Emotet finds its way onto computers through Phishing emails [4].  The malware is embedded within a Microsoft document attached to the email which is labeled with something to do with payroll or financial information.  This is a common social engineering technique used by adversaries to trick victims into downloading their malware.  This document will contain a macro that a user is required to click to view the information in the document.  Upon clicking this macro, the computer will run a PowerShell script downloading Emotet onto the victim’s computer [5].  After Emotet is downloaded it will download additional toolkits containing other malware such as TrickBot. These toolkits are used for persistence to create backdoors for later use by adversaries.  If the compromised computer is a part of a high-profile organization like UHS, adversaries will download and run Ryuk.  When running Ryuk for the first time it will search for all shadow copies, and backups of the computer [5].  If any backups are found the malware will delete it making it difficult to roll back the system to an uncompromised state.  Once all backups are removed it will then begin to search for physical and attached network storage devices [5].  After finding all the storage devices possible it will then encrypt all documents found on the storage devices with (Rivest-Shamir-Adleman) RSA and AES (Advanced Encryption Standard) encryption.  Once it is done it will leave a Hypertext Markup Language (HTML) document on the desktop of the computer with the ransom note demanding money [2].