Malware
Ryuk
- First Reported
- Aug 13, 2021
- Latest Reported
- Jul 14, 2026
Reported Context (4)
- most notably “Stern.” According to the EU, Kovalev is a senior figure of the Trickbot Group, including Ryuk and Conti ransomware and its many offshoots — among the most destructive malware programs in recent US, UK and EU Sanction Trickbot Figure “Stern” and Other Cybercrime Enablers
- of emerging ransomware variants. This is the first quarter in which we had no observations of the Ryuk ransomware, a variant that was often the most often observed variant from previous quarters. CTIR also Talos Q3 2021 Report: Ransomware Dominated Incident Response Engagements
- also included instructions on CVE-2020-1472 Zerologon exploitation in Cobalt Strike. In a previous Ryuk ransomware engagement from Q2 2021, we observed the adversary access several additional resources within Talos Analysis of Leaked Conti Ransomware Playbook Reveals Tools and Tactics
- It has been observed being used to deliver Ryuk ransomware and other payloads. Talos Roundup Details Malware Threats and Indicators Observed Aug. 6–13
CVE (2)
Malware (34)
People (12)
Threat Actors (12)
MITRE ATT&CK (24)
Vendors (6)
Products (27)
Tools (20)
Industries (18)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.