Microsoft details techniques of ransomware including REvil, Samas, Doppelpaymer, Bitpaymer, and Ryuk, which are manually controlled by humans, not automated
Ransomware attackers are using common tools to take down big enterprise with ‘human-operated’ attacks.
Context & Ripple Effects
Microsoft's breakdown of REvil, Samas, Doppelpaymer, Bitpaymer, and Ryuk formalizes what incident responders had been seeing: these are not automated worms but hands-on-keyboard intrusions driven by operators who move laterally with ordinary admin tooling — a pattern already visible when an earlier attack spread via Windows' remote admin tools like WMI and PsExec. The framing matters because it explains why the biggest crews concentrate on big game: researchers had already documented a group behind [[a:937481|Ryuk netting roughly $3.7M in Bitcoin by targeting only firms with huge resources and lying dormant for up to a year]].
The human-operated model also sets up everything that follows in this coverage arc — from the supply-chain reach of Kaseya-pushed REvil to the point where REvil itself was hacked and forced offline by a multi-country law enforcement operation, and Microsoft's later finding of destructive malware in Ukraine that mimics ransomware but has no recovery mechanism.
First-order effects
- Enterprise security teams have to treat living-off-the-land admin tools as attacker infrastructure, monitoring interactive operator behavior rather than just malware signatures.
- Microsoft converts its incident-response telemetry into published threat intelligence, sharpening its position as the default defender-of-record for large enterprises facing these crews.
Second-order effects
- Because human operators pick targets and pivot, managed service providers become force-multiplier victims — the model REvil later exploited by pushing ransomware through a Kaseya software update to hit multiple MSPs and thousands of downstream customers at once.
- Sustained, identifiable crews invite coordinated state responses rather than whack-a-mole takedowns, foreshadowing the multi-country operation that knocked REvil offline.
Third-order effects
- If ransomware is operator-driven rather than code-driven, the same tradecraft can be repurposed for pure destruction — exactly what Microsoft later flagged in Ukraine, where malware looked like ransomware but offered no way to recover, blurring the line between criminal extortion and state-aligned disruption.
- Structurally, big-game hunting pushes the market toward segmented networks, privileged-access management, and cyber-insurance underwriting that prices human-operated intrusion risk differently than commodity malware.
The trend: Ransomware has shifted from automated mass infection to manually operated enterprise intrusion campaigns, a trajectory running from WMI-and-PsExec lateral movement through supply-chain strikes to destructive pseudo-ransomware with no recovery path.