malware family

Ryuk

unknownentity:malware_familyransomware · 1 source

[Ryuk](https://attack.mitre.org/software/S0446) is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. [Ryuk](https://attack.mitre.org/software/S0446) shares code similarities with Hermes ransomware.(Citation: CrowdStrike Ryuk January 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: FireEye FIN6 Apr 2019)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: ryuk
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 94 · 0 attributions · 2 relations · 0 events

Identifiers

attack S0446via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatFIN6usesRyuk
fetch —sha256 dc1639caa5501d72
rel_143btcintel:relations:143@v1 sha256:e6d2ed1c130fe2f4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatWIZARD SPIDERusesRyuk
fetch —sha256 dc1639caa5501d72
rel_585btcintel:relations:585@v1 sha256:2029c656ae7a4d24
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 94

Ryukransomwarepayment
subjecttransaction715a5bc136…8151a8eb1e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322 · 1,500,095,545 sat · time 2019-07-31 19:45 UTC · url https://ransomwhe.re/#address/3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_3072btcintel:annotations:3072@v3 sha256:544bc48945c9c486
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransaction5a17b28d93…1f37949474
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322 · 7,500,100,000 sat · time 2019-09-27 12:26 UTC · url https://ransomwhe.re/#address/3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_3071btcintel:annotations:3071@v3 sha256:7bae7575b3e3f93e
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/3LE4u2csMS9y1MdfgBZ3pDmnDg7VCtX322
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_3070btcintel:annotations:3070@v2 sha256:864e2f330ce874f3
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress162DVnddxsbXeVgdCy66RxEPADPETBGVBR
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/162DVnddxsbXeVgdCy66RxEPADPETBGVBR
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_3065btcintel:annotations:3065@v2 sha256:4641673cc48da18a
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress15LsUgfnuGc1PsHJPcfLQJEnHm2FnGAgYC
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/15LsUgfnuGc1PsHJPcfLQJEnHm2FnGAgYC
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_3062btcintel:annotations:3062@v2 sha256:ea913e08dcf329d9
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransaction4b6b580c76…09e50c6ffc
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op · 2,500,000,000 sat · time 2018-10-01 18:30 UTC · url https://ransomwhe.re/#address/19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_3032btcintel:annotations:3032@v3 sha256:163f0f28a89a1680
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_3031btcintel:annotations:3031@v2 sha256:d44acb361c43a696
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress12N7W9ycLhuck9Q2wT8E6BaN6XzZ4DMLau
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/12N7W9ycLhuck9Q2wT8E6BaN6XzZ4DMLau
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2533btcintel:annotations:2533@v2 sha256:f2b4f3ce098eb51d
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress17v2cu8RDXhAxufQ1YKiauBq6GGAZzfnFw
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/17v2cu8RDXhAxufQ1YKiauBq6GGAZzfnFw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2495btcintel:annotations:2495@v2 sha256:010248c75c727877
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransactiona29c1aaed5…7ed270bcec
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Jq3WwsaPA7LXwRNYsfySsd8aojdmkFnW · 3,500,000,000 sat · time 2018-11-01 02:18 UTC · url https://ransomwhe.re/#address/1Jq3WwsaPA7LXwRNYsfySsd8aojdmkFnW
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2494btcintel:annotations:2494@v3 sha256:6ac66fa39af6d0fe
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress1Jq3WwsaPA7LXwRNYsfySsd8aojdmkFnW
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/1Jq3WwsaPA7LXwRNYsfySsd8aojdmkFnW
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2493btcintel:annotations:2493@v2 sha256:fdd6c225cbf7cfb2
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransaction6a78f46b9a…9e9990d0ad
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm · 2,500,000,000 sat · time 2018-10-31 19:01 UTC · url https://ransomwhe.re/#address/1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2492btcintel:annotations:2492@v3 sha256:05d2f369fe7df8e3
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransactiond819ae6fc6…a3f87acce6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm · 899,998,590 sat · time 2018-11-01 17:38 UTC · url https://ransomwhe.re/#address/1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2491btcintel:annotations:2491@v3 sha256:d1c30b782ad011ac
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransactiond588f02894…c14d1376e6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm · 500,000,000 sat · time 2018-11-09 01:55 UTC · url https://ransomwhe.re/#address/1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2490btcintel:annotations:2490@v3 sha256:c9d36dad6a9e858b
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2489btcintel:annotations:2489@v2 sha256:a24804035281d84e
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransaction6007915c9c…6486d4c227
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp · 1,500,000,000 sat · time 2018-08-11 20:01 UTC · url https://ransomwhe.re/#address/1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2488btcintel:annotations:2488@v3 sha256:664ca6bd44ce98c2
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2487btcintel:annotations:2487@v2 sha256:c9f57f47b2df960f
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress17zTcgKhF8XkWvkD4Y1N8634Qw37KwYkZT
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/17zTcgKhF8XkWvkD4Y1N8634Qw37KwYkZT
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2483btcintel:annotations:2483@v2 sha256:067e6cdeef87fe05
confidencetrusted provider · 50
Ryukransomwarepayment address
subjectaddress1EoyVz2tbGXWL1sLZuCnSX72eR7Ju6qohH
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Ryuk · url https://ransomwhe.re/#address/1EoyVz2tbGXWL1sLZuCnSX72eR7Ju6qohH
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2480btcintel:annotations:2480@v2 sha256:c8cac3a01ff17009
confidencetrusted provider · 50
Ryukransomwarepayment
subjecttransactione16451829c…fc275017b6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1ET85GTps8eFbgF1MvVhFVZQeNp2a6LeGw · 332,500,000 sat · time 2018-12-19 18:09 UTC · url https://ransomwhe.re/#address/1ET85GTps8eFbgF1MvVhFVZQeNp2a6LeGw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2477btcintel:annotations:2477@v3 sha256:31de5ede19471b66
confidencetrusted provider · 50

Subjects94 subjects carry a claim naming this entity · a sample

129L4gRSYgVJTRCgbPDtvYPabnk2QnY9sqaddress
12N7W9ycLhuck9Q2wT8E6BaN6XzZ4DMLauaddress
12UbZzhJrdDvdyv9NdCox1Zj1FAQ5onwx3address
12vsQry1XrPjPCaH8gWzDJeYT7dhTmpcjLaddress
13rTF3AYsf8xEdafUMT5W1E5Ab2aqPhkPiaddress
14aJo5L9PTZhv8XX6qRPncbTXecb8Qohqbaddress
14dpmsn9rmdcS4dKD4GeqY2dYY6pwu4nVVaddress
15FC73BdkpDMUWmxo7e7gtLRtM8gQgXyb4address
15LsUgfnuGc1PsHJPcfLQJEnHm2FnGAgYCaddress
15RLWdVnY5n1n7mTvU1zjg67wt86dhYqNjaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.