Malware · critical

How to fixRYUK_RANSOMWARE

Ryuk Enterprise Ransomware

What this error means

Ryuk Enterprise Ransomware is a critical-severity malware/security issue. Ryuk is a sophisticated ransomware variant targeting large enterprises and critical infrastructure. It is typically deployed manually by attackers after gaining access via phishing (often via Emotet or TrickBot) and lateral movement. It sometimes comes down to compromised Remote Desktop Protocol (RDP) entry points. See the troubleshooting steps below for the fix.

Before you begin

Save open work and back up important files. Note any recent driver or hardware changes. If Windows cannot start, use the startup guide first.

Work through these checks

0 of 4 complete
01Enforce multi-factor authentication (MFA) on all remote logins

Enforce multi-factor authentication (MFA) on all remote logins.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
02Disable RDP or secure it behind a VPN

Disable RDP or secure it behind a VPN.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
03Deploy Endpoint Detection and Response (EDR) agents

Deploy Endpoint Detection and Response (EDR) agents.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
04Reconstruct systems from isolated, immutable backups

Reconstruct systems from isolated, immutable backups.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help

Possible causes

  • Compromised Remote Desktop Protocol (RDP) entry points
  • Lateral movement of attackers using compromised admin credentials
  • Active botnet loaders like Emotet on the network