ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0446malware

Ryuk

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. Ryuk shares code similarities with Hermes ransomware.

Platforms: Windows

MITRE ATT&CK ↗

Linked entities · 24

usesT1027Obfuscated Files or Information usesT1106Native API usesT1057Process Discovery usesT1021.002SMB/Windows Admin Shares usesT1083File and Directory Discovery usesT1490Inhibit System Recovery usesT1614.001System Language Discovery usesT1078.002Domain Accounts usesT1059.003Windows Command Shell usesT1036.005Match Legitimate Resource Name or…usesT1489Service Stop usesT1222.001Windows Permissions usesT1685Disable or Modify Tools usesT1053.005Scheduled Task usesT1680Local Storage Discovery usesT1205Traffic Signaling usesT1486Data Encrypted for Impact usesT1055Process Injection usesT1036Masquerading usesT1547.001Registry Run Keys / Startup Folder usesT1016System Network Configuration Disc…usesT1134Access Token Manipulation uses byG0037FIN6 uses byG0102Wizard Spider