Researchers: a hacking group made ~$3.7M in Bitcoin since Aug. with Ryuk ransomware, which only targets firms with huge resources and can lay dormant for a year
Ryuk lies in wait for as long as a year, then pounces on only the biggest prey. — A recently discovered ransomware group …
Context & Ripple Effects
This January 2019 report is the earliest hard number on Ryuk's economics: researchers trace ~$3.7M in Bitcoin to a single group since August, and identify the strain's signature behavior — long dormancy inside networks, then strikes aimed only at firms with the resources to pay eight-figure-adjacent ransoms. At the time, that made Ryuk an outlier among spray-and-pray ransomware.
The later coverage shows how prescient that targeting thesis was: Ryuk went on to hit 235+ US hospitals and its operators were estimated to have cashed out $150M+ in Bitcoin through Binance and Huobi, while Chainalysis counted at least $350M across all ransomware gangs in 2020 with Ryuk as the top earner. The selective 'big game' model this article first documented became the category's dominant playbook.
First-order effects
- Large enterprises with substantial resources — not broad swaths of SMBs — are the immediate target set, and defenders now have to plan for intruders who can sit dormant for up to a year before detonating encryption.
Second-order effects
- Rivals copied the model rather than competing on volume: BlackMatter later told interviewers it only targets companies with $100M+ revenue, mirroring Ryuk's selectivity, while NetWalker's ~$25M haul showed mid-tier groups racing toward the same payout league.
Third-order effects
- If the pattern holds, ransomware consolidates into a few high-value 'big game' operations, and the money trail shifts the battleground to crypto cash-out points — exchanges like Binance and Huobi under pressure as chokepoints, with blockchain-analytics firms like Chainalysis becoming the de facto measurement layer for the whole criminal economy.
The trend: Ransomware is shifting from indiscriminate mass infection to patient, enterprise-targeted 'big game hunting,' where a handful of groups extract nine-figure annual totals and blockchain forensics becomes the primary countermeasure.