MITRE ATT&CKsoftware (malware)
S0446 Ryuk
- Domain
- enterprise, ics
- Platforms
- Windows
- Version
- 1.4
- Created
- 2020-05-13
Description
Related
Uses · MITRE ATT&CK (23)
- T1685 Disable or Modify Tools technique
- T1680 Local Storage Discovery technique
- T1614.001 System Language Discovery sub-technique
- T0828 Loss of Productivity and Revenue technique
- T1078.002 Domain Accounts sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1222.001 Windows Permissions sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1205 Traffic Signaling technique
- T1134 Access Token Manipulation technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1036 Masquerading technique
- T1055 Process Injection technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
References
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ Bleeping Computer - Ryuk WoL
- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html FireEye Ryuk and Trickbot January 2019
- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ CrowdStrike Ryuk January 2019
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html FireEye FIN6 Apr 2019