ATT&CK ReferencesANSSI RYUK RANSOMWARE

ANSSI RYUK RANSOMWARE

ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1036 Masquerading	MalwareRyuk	Ryuk can create .dll files that actually contain a Rich Text File format document. ANSSI RYUK RANSOMWARE
T1053.005 Scheduled Task	MalwareRyuk	Ryuk can remotely create a scheduled task to execute itself on a system. ANSSI RYUK RANSOMWARE
T1078.002 Domain Accounts	MalwareRyuk	Ryuk can use stolen domain admin accounts to move laterally within a victim domain. ANSSI RYUK RANSOMWARE
T1222.001 Windows Permissions	MalwareRyuk	Ryuk can launch `icacls <path> /grant Everyone:F /T /C /Q` to delete every access-based restrictions on files and directories. ANSSI RYUK RANSOMWARE

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.