royal

T1566.001Phishing: Spearphishing Attachment

A spearphishing email was sent to employees.

T1059.001Command and Scripting Interpreter: PowerShell

Cobalt Strike was executed through encoded PowerShell commands.

T1059.003Command and Scripting Interpreter: Windows Command Shell

Qbot was launched through the Windows Command Shell with cmd.exe.

T1543.003Create or Modify System Process: Windows Service

Cobalt Strike was installed as a Windows service on multiple systems.

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Qbot DLL was added to HKCUEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Run.

T1078.002Domain Accounts

Royal ransomware operators used (privileged) domain accounts for lateral movement.

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Royal ransomware operations executed a known UAC bypass that abuses a default scheduled task to launch PowerShell with escalated privileges.

T1027.006Obfuscated Files or Information: HTML Smuggling

Password protected file containing an ISO file with a hidden file used in combination with an LNK file to execute Qbot.

T1055Process Injection

Qbot and Cobalt Strike were both injected into legitimate Windows processes.

T1078.002Domain Accounts

Royal ransomware operators used domain accounts for lateral movement.

T1087.001Account Discovery: Local Account

The FindLocalAdmin PowerSploit script was used to find local administrator accounts on workstations/servers.

T1087.002Account Discovery: Domain Account

Users and groups were enumerated with built-in Windows utilities and with AdFind software.

T1135Network Share Discovery

Network shares were enumerated with PowerSploit software.

T1482Domain Trust Discovery

Domain trust was enumerated with built-in Windows utilities.

T1021.002Remote Services: SMB/Windows Admin Shares

Remote admin shares C$ were mounted from the Patient 0 workstation.

T1078.002Valid Accounts: Domain Accounts

Several (privileged) domain accounts were used during the attack for lateral movement and deployment of ransomware.

T1550.002Use Alternate Authentication Material: Pass the Hash

The Royal ransomware operators leveraged credential hashes from privileged accounts to perform lateral movement.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Royal ransomware operators used Mega Cloud Storage and Dropbox to exfiltrate data from multiple hosts.

T1071Application Layer Protocol

Cobalt Strike uses peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.

T1071.001Application Layer Protocol: Web Protocols

Qbot and Cobalt Strike used HTTPS traffic for their C2 communication.

T1486Data Encrypted for Impact

Royal ransomware encrypted files on systems with the .royal extension.