Attackers provided victims who paid with an updated Ryuk ransomware decryptor that could potentially damage their larger files.
Emsisoft found that malicious actors had added numerous new features to Ryuk ransomware over the past year.
In a lesser-known case, attackers gave Ryuk the ability to partially encrypt files that exceeded 54.4 MB in size. This update helped newer variants of the ransomware save time in their encryption process so that they could affect all relevant data before the victim notices.
Partially encrypted files demonstrate an unusual footer at the end of the file, which is where Ryuk’s Hermes file marker stores its RSA-encrypted AES key. This location also usually contains an indicator that shows how many 1,000,000-byte blocks are encrypted by the threat.