CrowdStrike Intelligence published a technical analysis on CrowdStrike of Sidoh (also known as Ryuk Stealer) — a rare, keyword-driven file exfiltration tool operated by Wizard Spider. Observed in only 16 unique SHA256 samples between June 16, 2019, and January 18, 2020, Sidoh searches local drives, network shares via ARP-discovered SMB hosts, and matches files by extension or filename/content keywords before uploading them via FTP to hardcoded C2 IP addresses. Its keyword list strongly suggests targeting of government, military intelligence, and financial sector data.
Ryuk Source Code DNA: Shared WinMain Logic, Different Visual Studio Build Chains
Sidoh superficially resembles Ryuk: both read a command-line argument as a file path, sleep 5,000 microseconds, then call DeleteFileW on that file. Code structure, API chains, and "feel" initially led CrowdStrike to dismiss early samples as Ryuk variants. Deeper analysis revealed differences: Sidoh and Ryuk are compiled on different machines with different Visual Studio installations (Ryuk: VC++ 14.0.x build 23918/23907 + VC++ 9.0 SP1; Sidoh: VC++ 14.0 build 24215/24210 + additional 14.0.x variants), indicating separate build environments. The presence of .RYK extension (Ryuk's encryption suffix) and RyukReadMe.txt/UNIQUE_ID_DO_NOT_REMOVE in Sidoh's deny list suggests either Ryuk source code reuse or deliberate compatibility with Ryuk-encrypted environments.
Enumeration: GetLogicalDrives, ARP-Based SMB Network Mounts, 50MB File Size Limit
Sidoh calls GetLogicalDrives and iterates each non-CD-ROM drive via GetDriveTypeW. It also calls GetIpNetTable to retrieve ARP cache entries, attempts to mount each IP as a network drive via SMB, and searches those shares. Files are enumerated via FindFirstFileW/FindNextFileW. Files over 50MB (20MB in earlier variants) are skipped. Automatic exfiltration triggers on extensions: .cpp, .h, .xls, .xlsx, .doc, .docx, .docb, .pdf, and wallet.dat. Other files are exfiltrated if their filename contains any keyword from a list including: SECURITY, NSA, FBI, NATO, military, submarine, tactical, classified, bribery, contraband, clandestine, SWIFT, IBAN, and others — many misspelled (e.g., Engeneering) or concatenated (e.g., treasonrestricted), suggesting the list was hastily assembled. Early variants also searched file contents of .docx/.xlsx via libzip.dll, but a bug caused .xlsx content search to fail (reading column mapping XML rather than xl/SharedStrings.xml); this feature was removed in the newer variant.
FTP Exfiltration to Hardcoded C2 IPs: Anonymous Auth, Random-Prefix Filenames, and Retry Logic
Matched files are uploaded via FTP to hardcoded C2 IP addresses using anonymous credentials (anonymous/anonymous), stored in a hardcoded remote directory with four random digits prepended to the original filename. Most variants include a backup C2 IP. On connection failure, Sidoh sleeps a random interval (0–125 seconds) and retries. After three consecutive C2 failures, it performs a keyword scan of the pending file's name or contents; if a keyword match is found, it makes three additional connection attempts with the same retry-sleep logic. Failed files are discarded and enumeration continues. The combination of government/military/financial keywords, rare deployment (16 samples over seven months), and uncertain intent (espionage vs. extortion value assessment) makes Sidoh one of Wizard Spider's most analytically ambiguous tools.