You can use the Malwarebytes Anti-Malware Nebula console to scan your endpoints. Choose the Scan + Quarantine option. Afterwards, you can check the Detections page to see which threats were found. On the Quarantine page you can see which threats were quarantined and restore them if necessary. Take a close look at the Detections page to see if you can find the answer to how Ryuk was delivered. You do not want to leave any backdoors behind that the attackers can use again!
If you suspect the delivery of Ryuk has been carried out by Emotet, you will need to perform some extra steps. If your computer is connected to a network—isolate it immediately. Once isolated, make sure you patch and clean the infected system. But that’s not all. Because of the way Emotet spreads across your network, a clean computer can be re-infected when plugged back into an infected network. Clean each computer on your network one-by-one. It’s a tedious process, but Malwarebytes business solutions can make it easier, isolating and remediating infected endpoints and offering proactive protection against future Emotet infections.
If you suspect the delivery of Ryuk has been carried out by Emotet, you will need to perform some extra steps. If your computer is connected to a network—isolate it immediately. Once isolated, make sure you patch and clean the infected system. But that’s not all. Because of the way Emotet spreads across your network, a clean computer can be re-infected when plugged back into an infected network. Clean each computer on your network one-by-one. It’s a tedious process, but Malwarebytes business solutions can make it easier, isolating and remediating infected endpoints and offering proactive protection against future Emotet infections.