Threat Assessment: Ryuk Ransomware
Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.
A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.
- Joint CISA/FBI/HHS alert flagged increased Ryuk threat to healthcare
- UHS Ryuk attack disrupted all U.S. facilities for weeks
- Trickbot Anchor_DNS module uses DNS tunneling for C2
- Ryuk deployment often delayed weeks or months after initial infection
- ATT&CK
- T1566.001 Spearphishing AttachmentT1486 Data Encrypted for ImpactT1071.004 DNST1082 System Information Discovery
- Vendors
- Palo Alto Networks
- Products
- WildFireCortex XDRDNS Security
- Malware
- RyukTrickbotBazaLoader
- Victims
- Universal Health Services
- Organizations
- CISAFBIHHSPalo Alto NetworksUnit 42
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.ipify.org | itimate domains may be used during this check: ipecho[.]net api[.]ipify[.]org checkip[.]amazonaws[.]com ip[.]anysrc[.]net wtfismyip[. |
| domain | ip.anysrc.net | k: ipecho[.]net api[.]ipify[.]org checkip[.]amazonaws[.]com ip[.]anysrc[.]net wtfismyip[.]com ipinfo[.]io icanhazip[.]com myexternali |
| domain | wtfismyip.com | i[.]ipify[.]org checkip[.]amazonaws[.]com ip[.]anysrc[.]net wtfismyip[.]com ipinfo[.]io icanhazip[.]com myexternalip[.]com Table 1. L |
From the original article
11 min read at unit42.paloaltonetworks.com
On Oct. 28, 2020, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (HHS) released a joint cybersecurity alert regarding an increased and imminent cybersecurity threat to the U. S.
By Doel Santos, Brad Duncan, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.