ryuk

Ryuk ransomware is attributed to the Russia-based Wizard Spider cybercriminal group and was one of the most damaging ransomware strains between 2018 and 2021, responsible for over $150 million in ransom payments. The group targeted hospitals, government agencies, and large enterprises following TrickBot or BazarLoader infections, causing significant disruption to US healthcare during the COVID-19 pandemic. Wizard Spider evolved Ryuk into the Conti ransomware operation in 2020, effectively retiring the Ryuk brand and consolidating operations under the more capable Conti platform.