type: entity · created: 2026-07-11 · updated: 2026-07-11 · tags: [ransomware-group, ransomware, le-action] · confidence: high · affected_sectors: [healthcare, finance, technology] · au_impact: true
🎯 IOCs · TrickBot
Indicators of compromise · TrickBot — 1 shown
189[.]195[.]96[.]238:443
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Ryuk
Ryuk is a prolific ransomware variant and the associated cybercriminal operation that caused hundreds of millions of dollars in damages globally — including significant healthcare sector disruptions. In July 2026, a Ryuk operator pleaded guilty in the UK.
Law Enforcement Action
- July 11, 2026: A Ryuk ransomware operator pleaded guilty in the UK
- Demonstrates ongoing international cooperation in dismantling ransomware operations
- Ryuk caused significant disruptions including healthcare sector incidents (raw/digests/Cyber-Digest-2026-07-11.md)
Historical Impact
- Hundreds of millions in damages globally
- Significant healthcare sector disruptions (Ryuk was heavily used against hospitals)
- Typically deployed via TrickBot or BazarLoader infections
Related Pages
- Blackcat Alphv — Related ransomware group (contemporaneous sentencing)
- Scattered Spider — Another ransomware-focused threat group
- Goddamn Ransomware — Current ransomware variant
- Fortibleed — Infrastructure vulnerability exploited by ransomware gangs