Between 2018 and 2021, the most common path to a devastating ransomware infection followed a three-stage chain: Emotet delivered TrickBot, which delivered Ryuk ransomware. Each component had its own operators, its own criminal business model, and its own infrastructure - but they worked together in a loosely coordinated cybercrime supply chain that extracted hundreds of millions of dollars from hospitals, schools, governments, and businesses worldwide. Understanding this chain is essential to understanding how modern enterprise ransomware works, because the same layered delivery model that Emotet pioneered is still the dominant approach.

Emotet began life in 2014 as a banking trojan designed to steal credentials from online banking sessions. By 2018, its operators had pivoted to a different business model: selling access. Emotet had evolved into the world's most capable malware distribution platform - a "malware as a service" botnet that would, for a fee, deliver any malware to any system already infected with Emotet. TrickBot was among its biggest customers. When Emotet infected a corporate network and TrickBot was deployed, TrickBot's reconnaissance capabilities identified high-value targets. The Ryuk ransomware group (known to researchers as WIZARD SPIDER) then paid TrickBot's operators for access to those high-value networks and deployed their ransomware manually through TrickBot's existing foothold.

Emotet: The Perfect Delivery Mechanism

Emotet spread primarily through malicious email campaigns - hundreds of thousands of emails per day during peak operation. The emails were notable for their quality: Emotet hijacked existing email threads, inserting malicious replies that appeared to continue legitimate conversations between real people. If an Emotet-infected machine had a conversation in its email history between Alice and Bob, Emotet would send an email appearing to come from Bob, replying to the actual prior conversation, containing a malicious attachment or link.

This "email thread hijacking" made Emotet phishing emails extraordinarily effective. Recipients saw email from a known contact continuing an actual conversation they had participated in - far more convincing than generic phishing. The malicious documents typically contained obfuscated macros that, when enabled, downloaded and executed the Emotet payload. Emotet then harvested the new machine's email contacts and history, expanding both the contact pool for future phishing and the scope of thread hijacking available.

Once inside a network, Emotet used various techniques to spread laterally: exploiting EternalBlue (MS17-010) on unpatched systems, brute-forcing SMB credentials using a built-in password list, and leveraging WMI (Windows Management Instrumentation) and scheduled tasks for execution on discovered hosts. A single infected employee could result in Emotet spreading to hundreds of workstations across a corporate network within hours.

[TECHNICAL NOTE]
Emotet's malware-as-a-service infrastructure architecture: Emotet was operated by the group known as TA542 or MUMMY SPIDER. The Emotet botnet was organized into three separate "epochs" or sub-botnets (Epoch 1, 2, 3) during its peak operation, each with separate C2 infrastructure, encryption keys, and payload configurations. This partitioned architecture provided resilience - if one epoch was disrupted, the others continued operating. Emotet C2 used a tiered system: first-tier C2 servers received encrypted communications from infected endpoints; second-tier servers managed first-tier infrastructure. Communication was encrypted using RSA and used HTTP over ports 80/443 to blend with normal traffic. Emotet's payload delivery was sophisticated: it encrypted its additional payloads (TrickBot, QakBot, IcedID, and others) within itself, delivering them only to confirmed live Emotet infections. The "loader" model meant Emotet clients would receive different secondary payloads based on their geographic location, time of infection, and the current payload agreement between Emotet operators and their "customers." TrickBot access was consistently among the highest-value payloads in Emotet's catalog, reflecting the Ryuk ransomware revenue that flowed downstream.

TrickBot: The Reconnaissance and Access Broker

TrickBot (operated by WIZARD SPIDER alongside Ryuk) began as a banking trojan in 2016 but evolved into a comprehensive network reconnaissance and persistence tool. Where Emotet spread broadly and quickly, TrickBot moved more carefully - its goal was not maximum spread but maximum intelligence gathering about the specific network it inhabited.

TrickBot's modules collected: domain credentials (via keylogging and browser credential theft), Active Directory structure (enumerating domain controllers, organizational units, user accounts), network topology (mapping subnets, live hosts, accessible services), and browser-stored credentials. Its "pwgrab" module collected credentials from Chrome, Firefox, IE, and Edge. Its "networkDll" module mapped the network. A dedicated module targeted Citrix and Remote Desktop environments. TrickBot operators would analyze this intelligence and, for networks meeting their criteria (sufficiently large, sufficiently valuable), sell manual access to the Ryuk ransomware operators.

The Ryuk operators would then use TrickBot's existing access - already deep inside the network with domain credentials in hand - to move to domain controller access, disable backup systems and security software, and deploy Ryuk ransomware to every accessible machine simultaneously.

[WARNING]
The Emotet-TrickBot-Ryuk chain demonstrated that the most dangerous ransomware attacks were not automated - they involved human operators who spent days or weeks inside a network before activating ransomware. The dwell time between initial Emotet infection and Ryuk deployment averaged 1-2 weeks in documented cases, with some extending to months. During this time, defenders had multiple opportunities to detect and eject the attackers - Emotet infections triggered behavioral alerts in security tools, TrickBot's network scanning was detectable, and the attackers' preparation activities (disabling shadow copies, identifying backup servers, escalating privileges) generated log evidence. Organizations that detected and remediated Emotet infections promptly often avoided the Ryuk stage. Organizations that did not monitor alerts or that had security controls in name only were devastated. The hospitals and municipal governments that suffered the worst Ryuk incidents typically had neither the monitoring nor the response capability to catch the attack during the weeks-long preparation window.

Ryuk's Targets and Impact

Ryuk ransomware (named for a character from the manga Death Note, as was common among ransomware operators in this period) was deployed exclusively against high-value enterprise targets. The operators pre-screened victims through the TrickBot intelligence before deploying, looking for organizations with large enough revenues to pay multimillion-dollar ransoms and sufficient dependence on their IT systems to face catastrophic operational impact.

The healthcare sector was hit particularly hard. Universal Health Services suffered a nationwide Ryuk attack in September 2020, with 400+ hospitals across the US and UK losing access to systems for weeks. Staff had to revert to paper records, ambulances were diverted, surgeries were delayed. The recovery cost was estimated at $67 million. Ryuk attacks against hospitals during COVID-19 directly endangered patient care at a moment of maximum healthcare system stress.

School districts, municipal governments (the City of New Orleans was hit in December 2019, costing $7 million), and logistics companies were also frequent targets. Total Ryuk ransom payments through 2021 are estimated at over $150 million based on tracked blockchain transactions, with actual losses from downtime and recovery far exceeding that figure.

[IOC]
Emotet-TrickBot-Ryuk chain IOCs: Emotet initial infection via macro-enabled Office documents (.doc, .docm); malicious macros download Emotet via PowerShell (often using certutil, bitsadmin, or PowerShell Invoke-WebRequest). Emotet C2: rotating IP list in malware config (community-maintained lists at abuse.ch). Emotet persistence: scheduled tasks, registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). TrickBot delivered as EXE by Emotet; TrickBot persistence via Windows Service or scheduled task. TrickBot modules stored as files with extensions like .rdl or .dll in %AppData%. Ryuk deployment typically via TrickBot's VNC or meterpreter/Cobalt Strike session; Ryuk drops a batch script to disable shadow copies (vssadmin delete shadows /all /quiet), stop services, and kill processes before encryption. Ryuk ransom note: RyukReadMe.txt. Ryuk encryption: AES-256 per file, RSA-2048 encrypted key. Encrypted file extension: .RYK. Operation Ladybird (Emotet takedown): January 27, 2021, coordinated by Europol across 8 countries; Emotet infrastructure seized, botnet used to deliver Emotet uninstaller to infected machines on April 25, 2021. TrickBot: continued operating after Emotet takedown, disrupted by multiple law enforcement and private-sector operations through 2022. Conti ransomware largely replaced Ryuk from the same WIZARD SPIDER operators in 2020.