Credential Theft
- Mimikatz
- NirSoft Dialupass
- NirSoft IEPassView (iepv)
- NirSoft MailPassView
- NirSoft Netpass
- NirSoft RouterPassView
Ransomware group
Royal Ransomware
Royal Ransomware is a ransomware threat group/operator tracked in reporting under the names "royal_ransomware" and "royal_ransomware_group." The provided content describes it as an active ransomware actor observed using multiple initial access vectors, including phishing, RDP compromise, credential abuse, vulnerability exploitation, malicious downloaders, and malvertising via Google ads.
Profile source: Mallory opens in a new tabRoyal Ransomware
Family profile
Royal Ransomware is a ransomware threat group/operator tracked in reporting under the names "royal_ransomware" and "royal_ransomware_group." The provided content describes it as an active ransomware actor observed using multiple initial access vectors, including phishing, RDP compromise, credential abuse, vulnerability exploitation, malicious downloaders, and malvertising via Google ads. Reporting in the content places the group as active in 2022, including alleged victim postings involving Mark-Taylor, an Arizona builder, and a full-service commodities broker. The content also states that BlackSuit was formed from members of the older Royal ransomware group, indicating Royal predates BlackSuit and that personnel overlap or evolution occurred between the two groups. No high-confidence information about the group's size or physical location is provided in the content.
Ransomware.live
Operational record
Defense Evasion
- Eraser
- GMER
- NSudo
- PowerTool
Discovery Enum
- AdFind
- Advanced IP Scanner
- SharpShares
- SoftPerfect NetScan
Exfiltration
- RClone
LOLBAS
- PsExec
Networking
- Chisel
- Cloudflared
- OpenSSH
Offsec
- Brute Ratel C4
- Cobalt Strike
RMM Tools
- AnyDesk
- Atera
- LogMeIn
- MobaXterm
- Syncro
MITRE ATT&CK
Royal Ransomware in ATT&CK
19 distinct techniquesTechniques
19 techniques T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1078.002 Domain Accounts T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control T1027.006 Obfuscated Files or Information: HTML Smuggling T1055 Process Injection T1087.001 Account Discovery: Local Account T1087.002 Account Discovery: Domain Account T1135 Network Share Discovery T1482 Domain Trust Discovery T1021.002 Remote Services: SMB/Windows Admin Shares T1550.002 Use Alternate Authentication Material: Pass the Hash T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage T1071 Application Layer Protocol T1071.001 Application Layer Protocol: Web Protocols T1486 Data Encrypted for Impact
Reporting
Research mentioning Royal Ransomware
Jul 28
Risky Biz Rss
Risky Bulletin: Old exploit database finds its way online again
BlackSuit had been active since mid-2023 and was formed from members of the old Royal ransomware group.
Nov 3
Optiv
Vertical Target Series: Industrials and Industrial Sub-Verticals
Royal ransomware operators have been observed gaining initial access via phishing attacks, RDP compromises, credential abuse, vulnerability exploitation, malicious downloaders, and malvertising on Google ads.
Dec 20
Cyber Show
2022 Year in Rear View
A new ransomware group war is brewing as Royal Ransomware backdated a post for Mark-Taylor, an Arizona builder dated December 13th that Hive Ransomware posted on December 14th.
