Ryuk ransomware is a type of targeted ransomware used to encrypt files on compromised systems and demand payment for restoring access. Attackers typically gain initial access through phishing emails, malware infections, stolen login credentials, or vulnerable remote-access services. Once inside a network, Ryuk can move laterally, compromise additional devices, encrypt critical data, and disable backup or recovery mechanisms. It is particularly dangerous for healthcare organisations because an attack can interrupt clinical systems, restrict access to patient records, delay appointments and treatments, and cause significant operational downtime.
Healthcare organizations are the leading target for cybercriminals due to the perceived high value of data obtained on a successful attack. The RYUK ransomware healthcare attacks have been a major fiasco in the industry. The number of cyber-attacks on healthcare organizations has been increasing exponentially over the past few years, with the intensity of attacks hitting its bar in the second half of 2020. On October 28, 2020, the federal government released a report concerning an attack on six hospitals in the United States over a period of 24 hours beginning October 26, 2020. In the report, the federal government identified the attacks as the Ryuk Ransomware healthcare attacks.
It noted that a list of 400 hospitals targeted by the ransomware had circulated among Russian hackers. Ryuk Ransomware encrypts information within the computer system of an organization, making it unusable. The hospitals that reported outages following the attack include Sky Lakers Medical Center, which was forced to purchase 2 000 new computers in the recovery process. Other hospitals that were affected include Klamath Falls and St. Lawrence Health System, among others whose names were not revealed. Ever since the increased activity of the ryuk ransomware healthcare has seen massive impact and damage.
How Ryuk Ransomware Infects a System
The user receives a phishing email that, when clicked, downloads a Trojan that paves the way for Ryuk operators. After being downloaded into the system, the malware spreads itself internally to other machines over SMBv1 and steals the system and administrator credentials which it transmits to the attacker. The Trojan then gives the attacker the command and control of victim machines, allowing them to push Ryuk ransomware into the system.
After gaining access and taking control over the system, Ryuk places ransomware payloads on the devices connected to the affected network through PowerShell Empire. It establishes persistence and deletes backups as well as shadow files before initiating the file encryption process. The ransomware then begins downloading additional exploitation tools while at the same time encrypting files using RSA-2048 and AES-256. The files are renamed to include a .ryk, an extension used by Ryuk. Finally, the display on computer screens is changed; in most cases, they display a note “Shadow of the Universe”, a typical Ryuk phrase.
X-PHY Protection Method
Ryuk ransomware healthcare attack initiates by user action involving downloading Trojan into a system device, creating a backdoor, which gives the attackers command and control over the compromised system. At this point, your files’ safety relies on the NAND level protection only offered by X-PHY AI Cyber Secure SSD. X-PHY trusts no one and will always be your last line of defense to protect your valuable data.When Ryuk gets into the storage, X-PHY detects it, raising an alarm and initiating lockdown to keep data safe.
The SECURITY SCOUT and GUARDIAN PRO-X features of the X-GUARD THREAT LOCK perform continuous security checks on the storage device to detect any anomalies in the device activity. In this case, the first course of action taken by the malware involves stealing and sending system and administrator credentials to the attacker. These operations will lead to increased read operations which surpasses the normal read operations in the Nand flash. The trained AI algorithm will detect an abnormal increase in the read operations associated with stealing of system and administrator credentials. As such, it will classify this activity as malicious, triggering the X-Factor Encryption lock feature to initiate system lockdown and raise an alert. The lockdown will prevent Ryuk from accessing Nand flash, keeping system data safe, and stopping the attack.
