Ransomware infection that hit Chicago-based Tribune Publishing disrupted U.S. newspapers in December 2018. Some media outlets cited Ryuk’s reuse of Hermes ransomware code as evidence that North Korea is behind the attack. Cybercrime groups, not nation-states, are the most likely culprits, according to researchers from Coveware and security firm McAfee. The average opening demand from Ryuk attackers was to be paid $145,000, although victims could negotiate that down by about 60 percent, to an average of $71,000.”]
Source: https://www.govinfosecurity.com/11-takeaways-targeted-ryuk-attacks-pummel-businesses-a-12040