{"id":39043,"date":"2021-01-07T19:22:43","date_gmt":"2021-01-07T19:22:43","guid":{"rendered":"http:\/\/c0fe6f30-7ea7-49d8-816a-d18eca3ead11"},"modified":"2021-01-07T19:22:43","modified_gmt":"2021-01-07T19:22:43","slug":"ryuk-gang-estimated-to-have-made-more-than-150-million-from-ransomware-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ryuk-gang-estimated-to-have-made-more-than-150-million-from-ransomware-attacks\/","title":{"rendered":"Ryuk gang estimated to have made more than $150 million from ransomware attacks"},"content":{"rendered":"
\"dollar-money-rain.jpg\"<\/span>
<\/span> Image: QuinceCreative <\/span><\/figcaption><\/figure>\n

The operators of the Ryuk ransomware are believed to have earned more than $150 million worth of Bitcoin from ransom payments following intrusions at companies all over the world.<\/p>\n

In a joint report<\/a> published today, threat intel company Advanced Intelligence and cybersecurity firm HYAS said they tracked payments to 61 Bitcoin addresses previously attributed and linked to Ryuk ransomware attacks.<\/p>\n

“Ryuk receives a significant amount of their ransom payments from a well-known broker that makes payments on behalf of the ransomware victims,” the two companies said. “These payments sometimes amount to millions of dollars and typically run in the hundreds of thousands range.”<\/p>\n

AdvIntel and HYAS say the extorted funds are gathered in holding accounts, passed to money laundering services, and are then either funneled back into the criminal market and used to pay for other criminal services or are cashed out at real cryptocurrency exchanges.<\/p>\n

But what the two companies have found odd was that while other ransomware groups typically used lesser-known exchanges to cash out funds, Ryuk converted Bitcoin into real fiat currency using accounts on two very well-established crypto-portals, such as Binance and Huobi, most likely using stolen identities.<\/p>\n

\"ryuk-earnings.png\"<\/span>