Malware attribution is always hard. However, researchers at Deloitte Argentina, Gabriela Nicolao and Luciano Martins, attributed Ryuk ransomware to CryptoTech, a little-known cybercriminal group that was observed touting Hermes 2.1 in an underground forum back in August 2017. Hermes 2.1, according to the researchers, is another name for Ryuk ransomware.