Ryuk ransomware Bitcoin addresses

Ryuk, active from 2018, targeted large organisations ("big game hunting") and demanded large Bitcoin ransoms, often after an earlier infection by TrickBot or Emotet malware.

If a ransom note asked you to pay one of these addresses, report the attack to the police before paying anyone. Paying a sanctioned group can be illegal. Check any address.

All

All ransomware families · What the ransomware data shows