Ryuk emerged as a targeted ransomware operation against enterprises, with operators using prior network access, credential collection, lateral movement, and hands-on deployment to encrypt critical systems and disrupt organizations in sectors including government, financial services, manufacturing, service providers, and high tech. Early reporting noted code and artifact overlap with HERMES ransomware previously associated with Lazarus, but later linked reports attributed observed Ryuk operations to crimeware actors using Emotet and TrickBot footholds and stated that North Korean involvement was unproven.