Ryuk has used multiple native APIs including "ShellExecuteW" to run executables,"GetWindowsDirectoryW" to create folders, and "VirtualAlloc", "WriteProcessMemory", and "CreateRemoteThread" for process injection.