‘Ryuk Stealer’ Searches for and Steals Confidential Files from Government, Military, and Law Enforcement

Security concept Lock on digital screen, illustration-4The newest strain of Ryuk ransomware has added new keywords and filetypes to expand its ability to find files with content that can be turned into money through sale, extortion, or ransom.

The last thing a bad guy wants to do is to spend time trying to find where in your network they can make money. Instead, they leverage automation to do it for them. In the case of the Ryuk Stealer, the new strain discovered by the MalwareHunterTeam incorporates a number of automation improvements that make it relatively easy to search for and find data of value:

  • Look for files with specific filetypes (including Office documents, PDFs, images, and C++ files)
  • Check the filenames of all matching filetypes against 55 keywords
  • Search through matching file content for 85 specific keywords

The terms used demonstrate the targeting of specific industries. For example “SWIFT” (Banking), “N-CSR” (Finance), “federal” (government), “investigation” (Law Enforcement), and “operation” (military).

This newly discovered attack represents what’s possible – work in a different industry? All that’s needed is to change the keywords utilized that are specific to your organization’s vertical and the bad guys have themselves another targeted attack campaign.

Educating users on the dangers of email and the web as primary attack vectors via Security Awareness Training helps to minimize the ability for an attacker leveraging such nasty malware as the Ryuk Stealer to infiltrate your network, find data of value, and exfiltrate it or hold it for ransom.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews