Ryuk Ransomware Earns $150 Million in Bitcoin: Detailed Report

A Deep Dive into Ryuk Ransomware’s $150 Million Bitcoin Earnings

Ransomware attacks continue to plague organizations globally, with Ryuk ransomware standing out as one of the most successful variants. According to a joint report by Advanced Intelligence and HYAS, Ryuk operators have amassed an estimated $150 million in Bitcoin since 2018.

Tracing Ryuk Ransomware Payments

The report reveals that payments were traced to 61 Bitcoin wallet addresses linked to Ryuk ransomware activities. These addresses collectively received substantial ransom payments from victims. After receiving funds, criminals move Bitcoin through intermediaries to disguise their origins before cashing out via prominent cryptocurrency exchanges.

Key Steps in the Laundering Process:

1. Collection of Ransom Payments: Victims transfer Bitcoin to addresses controlled by Ryuk operators.
2. Use of Intermediaries: Payments are routed through intermediaries or laundering services to obscure the money trail.
3. Cash-Out at Exchanges: Funds are ultimately transferred to well-known exchanges like Binance and Huobi, where they are withdrawn or used for illicit purposes.

Ryuk’s High-Value Targets

Since its emergence in August 2018, Ryuk ransomware has primarily targeted high-profile organizations, including:

• Hospitals: Disrupting critical healthcare services.
• Newspapers: Crippling media outlets.
• Local Governments: Victimizing municipalities like Jackson County and Key Biscayne with ransom demands in the millions.

Crypto Exchanges in the Crosshairs

Despite the availability of lesser-known exchanges, Ryuk operators favor established names like Binance and Huobi. These platforms require proof of identity for withdrawals, yet criminals circumvent these checks using fake IDs or other tactics.

Ryuk’s Financial Dominance Among Ransomware Gangs

The FBI previously reported that Ryuk was the top ransomware gang, earning over $61.26 million from February 2018 to October 2019. Today’s $150 million figure cements Ryuk’s position as the most profitable ransomware group on record.

Other Notable Ransomware Groups:

• REvil: Known for high-profile attacks but with unreported total earnings.
• Maze: Active in numerous high-value breaches.
• Egregor: Infiltrated hundreds of companies but lacks detailed financial reports.

In comparison, the Netwalker ransomware gang reportedly earned $25 million in ransom payments between March and August 2020, far below Ryuk’s total haul.

How to Mitigate Ransomware Risks

Given the staggering sums earned by ransomware groups, organizations must prioritize cybersecurity. Here are some tips:

• Regular Backups: Keep offline backups to recover data without paying ransom.
• Employee Training: Educate staff on phishing and ransomware threats.
• Endpoint Protection: Use advanced threat detection systems.
• Incident Response Plans: Develop a robust strategy for ransomware incidents.

Conclusion: A Persistent Threat

The success of Ryuk ransomware highlights the growing sophistication of cybercriminals and their reliance on cryptocurrency for illicit activities. As ransomware gangs continue to evolve, organizations must remain vigilant and proactive in their cybersecurity measures.

To learn more about the innovative startups shaping the future of the crypto industry, explore our article on latest news, where we delve into the most promising ventures and their potential to disrupt traditional industries.