Ryuk itself appeared on the radar of cybersecurity experts in August, when the security researchers MalwareHunterTeam reported five initial victims. An analysis by Check Point Research published later that month estimated that it had already netted the attackers more than $640,000, and that much of its code matched that of a known ransomware program called Hermes, which has been linked to the North Korean hacking group that many believe was behind the WannaCry attack.

Source: Los Angeles Times January 01, 2019 12:00 UTC