What Caused the Ryuk Ransomware Attack on Tribune?

Key takeaways

Ryuk ransomware significantly disrupted the distribution of major US newspapers over a weekend in December 2018.
The attack affected the Los Angeles Times, San Diego Union-Tribune, Wall Street Journal, and New York Times.
Initial suspicions suggested an international origin, but investigations pointed to links with North Korean cyber activities.
McAfee's analysis indicated that Ryuk shares similarities with the older Hermes ransomware, previously attributed to North Korean actors.

Recently, Tribune Publishing, publisher of some of the major US newspapers, reported about the Ryuk ransomware which disrupted the distribution of papers in the weekend of late December 2018. According to a news report, the attack delayed the distribution of Saturday editions of the Los Angeles Times and San Diego Union-Tribune and also stymied distribution of the West Coast editions of the Wall Street Journal and New York Times, which are printed at the Los Angeles Times’ Olympic printing plant in downtown Los Angeles.

Source of the Attack: McAfee’s Assessment

The company’s initial suspicion was that the attack originated outside of the country. However, specialists and investigators responded that it was too soon to confirm the source of the attack. Later, computer security software company Mcafee assessed the incident and investigated the source code of the malware confirming it’s a similarity with the older ransomware Hermes which hinted its origin to North Korea. Hermes ransomware has been used in the past by North Korean actors and the code blocks of Ryuk is very similar to Hermes. The McAfee Advanced Threat Research team was able to crack through the code and the characteristics of the malware, determining how the malware works, how the attackers operate, and how to detect it. The team hypothesized based on some of the known factors such as the technical indicators, cybercriminal characteristics, and evidence discovered on the dark web, that the Ryuk ransomware could be the result of a cybercriminal activity and may not be backed by a nation. Tribune had claimed that all data including the personal data of subscribers, online users, and advertising clients had not been compromised which only hints the intention behind the attack to be more focused at disabling the infrastructure as opposed to stealing information.

Inside The Ryuk Ransomware

The name: Ryuk is the name of a character in one of the popular Japanese Manga series “Death Note”. In manga comic, Ryuk drops a Death Note, which according to McAfee is a name that fits ransomware that drops ransom notes. The ransomware was named by its developer who apparently is a big fan of the manga, McAfee suspects. Technical indicators: The McAfee's research team also found that the functionalities of Ryuk and Hermes are generally equal. Comparing the compilation time and the Program Database(PDB) of the samples collected during the past months strongly indicates that Ryuk was an altered version of Hermes 2.1. The investigation also found out that Hermes 2.1 was offered by a Russian-speaking actor in an underground forum making the source code available for cybercriminals looking forward to making use of it. Although the research has proven worthy in terms of understanding how the malware works, how the attackers operate, and how to detect the threat the question of who is behind the attack still remains a mystery. As for now, the conclusion is based on a hypothesis and it states that Ryuk was part of a cybercrime operation developed from a tool kit offered by a Russian-speaking actor.

Inside Ryuk Ransomware That Brought Down America’s Leading Publisher Tribune

Key takeaways

Source of the Attack: McAfee’s Assessment

Inside The Ryuk Ransomware

Stay ahead with AI insights.