Ryuk Ransomware is targeting Oil & Gas industry

January 23, 2020

DARKReading.com discusses how Active Directory is being weaponized to spread the ransomware

Imagine not being able to access your control system because your SCADA system was a victim of ransomware! This article goes into some details of the attack which(surprise, surprise) starts out by someone being phished and clicking on a malicious link. This then infects the AD servers and any host that connects to active directory. An interesting fact about the Ryuk Ransomware is that it sits dormant for several months which allows it to infect many hosts before activating, as well as allowing for backups to be infected!