A U.S. federal court has sentenced Karen Vardanyan, an Armenian national, to prison for his role in Ryuk encryption-based attacks against victim organizations, and ordered him to pay more than $1.2 million in restitution to those victims. The case — prosecuted after Vardanyan's extradition to the United States — is another data point in a string of successful DOJ actions against ransomware operators and their affiliates.
Sentencing headlines like this are satisfying, but they can create a false sense of closure. Here is the uncomfortable operational truth I share with every client: Ryuk as a brand may be diminished, but its playbook is not. The tooling, tradecraft, and intrusion chain that Ryuk operators popularized — loader-delivered initial access, Cobalt Strike post-exploitation, RDP and PsExec lateral movement, shadow copy destruction, and staged mass encryption — is now the standard operating template for Conti descendants, LockBit, Black Basta successors, Akira, and a dozen other RaaS ecosystems active in 2026. The affiliate model means the arrest of one operator never retires the technique.
This post breaks down the Ryuk intrusion chain from a defender's perspective and gives your team concrete detection content that catches not just Ryuk, but the entire class of human-operated ransomware it exemplified.
The Ryuk Intrusion Chain: A Defender's Breakdown
Based on public reporting on the case and CISA's long-standing analysis of Ryuk operations (Alert AA20-302A), the typical Ryuk intrusion — and the tradecraft Vardanyan and co-conspirators were tied to — followed this pattern:
1. Initial access. Ryuk intrusions were rarely smash-and-grab. Access was typically brokered or staged through precursor malware families (Emotet, TrickBot, BazarLoader) or purchased from initial access brokers who harvested exposed RDP and VPN credentials. The dwell time between initial compromise and encryption frequently ran days to weeks.
2. Post-exploitation and reconnaissance. Once inside, operators deployed Cobalt Strike beacons, ran network and domain discovery (nltest, net group, AdFind, BloodHound), and dumped credentials via lsass memory access.
3. Lateral movement. PsExec, SMB/ADMIN$ service execution, and RDP were the movement workhorses. Ryuk operators deliberately sought domain controllers and backup infrastructure.
4. Defense impairment. Before detonation, operators killed security tooling and destroyed recovery options — most notably deleting Volume Shadow Copies via vssadmin and wbadmin, and disabling Windows recovery with bcdedit.
5. Impact. Mass encryption executed across the estate, often via batch scripts and Group Policy objects pushed from a domain controller, leaving RyukReadMe ransom notes in encrypted directories.
Affected Organizations and Exploitation Status
Ryuk historically hit healthcare, local government, education, and manufacturing hardest — and the affiliate ecosystem it spawned continues to target those sectors today. This is not a theoretical threat: human-operated ransomware remains one of the most frequently confirmed intrusion types in IR engagements we run, and the TTPs below remain under confirmed active exploitation in the wild by successor groups in 2026.
Detection Content
The detections below target the highest-fidelity, lowest-noise behaviors in the Ryuk-style intrusion chain. They are tuned to fire on the operator actions that have no legitimate business equivalent in most environments — shadow copy deletion, recovery disabling, and mass-encryption staging — plus precursor loader activity worth hunting.
---
title: Ransomware Shadow Copy Deletion via Vssadmin or Wbadmin
id: 3f9c1a72-8b4e-4d21-9c07-2a6e5f8b1047
status: experimental
description: Detects deletion of Volume Shadow Copies or backup catalogs, a hallmark pre-encryption step in Ryuk and successor ransomware operations.
references:
- https://attack.mitre.org/techniques/T1490/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
author: Security Arsenal
date: 2026/02/10
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\diskshadow.exe'
selection_cmd:
CommandLine|contains:
- 'delete shadows'
- 'delete catalog'
- 'delete systemstatebackup'
condition: selection_img and selection_cmd
falsepositives:
- Backup administrators performing catalog maintenance (rare; whitelist by account)
level: critical
---
title: Boot Recovery Disabled via Bcdedit
id: 6d2e8b41-1c7f-4a93-b5d2-9e0c3f7a6218
status: experimental
description: Detects bcdedit being used to disable Windows recovery mode or ignore boot failures, a common Ryuk-family pre-encryption action.
references:
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\bcdedit.exe'
CommandLine|contains:
- 'recoveryenabled no'
- 'bootstatuspolicy ignoreallfailures'
condition: selection
falsepositives:
- Hardening scripts in gold images (uncommon; verify change tickets)
level: critical
---
title: PsExec-Style Remote Service Execution for Ransomware Staging
id: 91a4c6d3-5e28-4f06-a8b1-7d9e2c4f5093
status: experimental
description: Detects PsExec and renamed PsExec clones used for remote execution, a primary Ryuk lateral movement and encryption deployment mechanism.
references:
- https://attack.mitre.org/techniques/T1569/002/
- https://attack.mitre.org/techniques/T1021/002/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.lateral_movement
- attack.execution
- attack.t1569.002
- attack.t1021.002
logsource:
category: process_creation
product: windows
detection:
selection_psexec:
Image|endswith:
- '\psexec.exe'
- '\psexesvc.exe'
- '\psexec64.exe'
selection_service:
CommandLine|contains:
- ' -s '
- 'accepteula'
- '\\\\'
condition: selection_psexec and selection_service
falsepositives:
- Legitimate SCCM/PDQ deployment tooling (scope out known management hosts)
level: high
The following KQL hunts the full pre-encryption behavior cluster in Microsoft Defender / Sentinel. A single hit is notable; two or more stages from the same host within a short window should page your IR team.
// Hunt: Ryuk-style pre-encryption behavior cluster (shadow copy deletion,
// recovery disabling, PsExec staging) across the last 14 days.
let lookback = 14d;
let TTPs = dynamic([
"vssadmin.exe", "wbadmin.exe", "diskshadow.exe",
"bcdedit.exe", "psexec.exe", "psexesvc.exe", "psexec64.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName has_any (TTPs)
| where ProcessCommandLine has_any (
"delete shadows", "delete catalog", "delete systemstatebackup",
"recoveryenabled no", "ignoreallfailures", "accepteula", "\\\\"
)
| summarize
CommandLines = make_set(ProcessCommandLine, 10),
Accounts = make_set(AccountName),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, FileName
| order by FirstSeen asc;
For endpoint forensics during triage or proactive hunting, this Velociraptor artifact sweeps for active or recently-run staging tooling, ransomware note artifacts, and suspicious processes launched from user-writable paths — a common Ryuk drop location pattern (%APPDATA%, %TEMP%, C:\Users\Public).
-- Hunt: Ryuk-style staging artifacts, ransom notes, and suspicious process
-- execution from user-writable paths
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|recoveryenabled|ignoreallfailures|accepteula)'
OR Exe =~ '(?i)(\\\\appdata\\\\|\\\\users\\\\public\\\\|\\\\temp\\\\).+\\.(exe|bat|ps1)$'
LET notes = SELECT FullPath, Size, Mtime
FROM glob(globs=[
'C:/Users/*/Desktop/*ReadMe*.txt',
'C:/Users/Public/**/*ReadMe*.txt',
'C:/**/RyukReadMe*',
'C:/**/HowToDecrypt*'
], accessor='ntfs')
WHERE Mtime > now() - 1209600
SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'RANSOM_NOTE_ARTIFACT' AS Name, FullPath AS CommandLine,
FullPath AS Exe, NULL AS Username, Mtime AS CreateTime
FROM notes
Remediation and Hardening Script
Use the following PowerShell to verify and enforce key anti-ransomware controls on Windows endpoints and servers. Run it as part of baseline hardening or post-incident verification. Review before applying to production — Controlled Folder Access in particular should be piloted in audit mode first.
# Ryuk-class ransomware hardening & verification script (run as Administrator)
# 1. Verify Volume Shadow Copies exist and System Protection is enabled
Get-ComputerRestorePoint -ErrorAction SilentlyContinue
vssadmin list shadows
# Re-enable System Protection on C: if disabled
Enable-ComputerRestore -Drive "C:\"
# 2. Enforce tamper-proof recovery settings
bcdedit /set {default} recoveryenabled Yes
bcdedit /set {default} bootstatuspolicy DisplayAllFailures
# 3. Enable Microsoft Defender ransomware protections
# Controlled Folder Access - pilot in AuditMode (1) before enforcing (2)
Set-MpPreference -EnableControlledFolderAccess AuditMode
Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Users"
# Block common ransomware-adjacent abuse (LSASS theft, Office child procs, PsExec-style abuse)
Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled # Block credential stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled # Block Office child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c -AttackSurfaceReductionRules_Actions Enabled # Block process creations from PSExec/WMI
# 4. Disable legacy attack surface: SMBv1 and PsExec-style remote service creation from non-admin tiers
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
# 5. Restrict and log PowerShell (precursor loaders abused it heavily)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 1 -Force
# 6. Audit: confirm no unauthorized local admins (ransomware operators add accounts)
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, ObjectClass, PrincipalSource
Strategic Remediation Priorities
Beyond endpoint controls, the organizations that survive Ryuk-class intrusions share these traits:
- Immutable, offline, or logically air-gapped backups. Ryuk operators specifically hunted backup infrastructure before detonating. Test restoration quarterly — a backup you have never restored is a hypothesis, not a control.
- Kill the initial access vectors. Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, M365), eliminate exposed RDP from the perimeter, and patch internet-facing services aggressively. Initial access brokers feeding ransomware crews still monetize exactly these gaps.
- Segment and tier. The blast radius in most Ryuk incidents traced to flat networks where a single compromised workstation could reach the domain controller. Enforce tiered administration and block workstation-to-workstation SMB/RDP except from designated management hosts.
- Monitor for the dwell time. The average Ryuk intrusion gave defenders days of detection opportunity before encryption. Detections on shadow copy deletion, mass GPO changes, and unusual service creation convert that dwell time into an eviction window.
- Exercise your IR plan. Tabletop a ransomware scenario that includes the decision points this case highlights: ransom negotiation, law enforcement engagement (FBI/IC3, CISA), restitution processes, and disclosure obligations.
The Bottom Line
The sentencing of a Ryuk affiliate is a win for law enforcement and for the victims who will receive restitution. But treat it as what it is: confirmation that the intrusion chain works well enough that people go to federal prison over it. Your adversaries in 2026 are running that same chain under different branding. The detections above are live, tested against the TTPs that made Ryuk infamous — deploy them, tune them, and make sure the next crew using this playbook trips an alarm before the encryption starts, not after.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.