royal
Activity analysis
HackerFeeds has tracked 211 victims claimed by royal since November 2022, most recently in July 2023 — ranking #30 of 332 groups (0.6% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in July 2023. Its most-targeted sector is Manufacturing (51 victims), followed by Business Services (33). The United States accounts for 24 victims (35% of those with a known location); 142 victims did not disclose a location.
Victims per year
- 202288
- 2023123
Top sectors
- Manufacturing51
- Business Services33
- Education19
- Healthcare13
- Consumer Services12
- Public Sector11
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.
MITRE ATT&CK TTPs
Initial Access
T1566.001Phishing: Spearphishing Attachment
A spearphishing email was sent to employees.
Execution
Persistence
Privilege Escalation
T1078.002Domain Accounts
Royal ransomware operators used (privileged) domain accounts for lateral movement.
T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
Royal ransomware operations executed a known UAC bypass that abuses a default scheduled task to launch PowerShell with escalated privileges.
Defense Evasion
T1027.006Obfuscated Files or Information: HTML Smuggling
Password protected file containing an ISO file with a hidden file used in combination with an LNK file to execute Qbot.
T1055Process Injection
Qbot and Cobalt Strike were both injected into legitimate Windows processes.
T1078.002Domain Accounts
Royal ransomware operators used domain accounts for lateral movement.
Discovery
T1087.001Account Discovery: Local Account
The FindLocalAdmin PowerSploit script was used to find local administrator accounts on workstations/servers.
T1087.002Account Discovery: Domain Account
Users and groups were enumerated with built-in Windows utilities and with AdFind software.
T1135Network Share Discovery
Network shares were enumerated with PowerSploit software.
T1482Domain Trust Discovery
Domain trust was enumerated with built-in Windows utilities.
Lateral Movement
T1021.002Remote Services: SMB/Windows Admin Shares
Remote admin shares C$ were mounted from the Patient 0 workstation.
T1078.002Valid Accounts: Domain Accounts
Several (privileged) domain accounts were used during the attack for lateral movement and deployment of ransomware.
T1550.002Use Alternate Authentication Material: Pass the Hash
The Royal ransomware operators leveraged credential hashes from privileged accounts to perform lateral movement.
Exfiltration
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
Royal ransomware operators used Mega Cloud Storage and Dropbox to exfiltrate data from multiple hosts.
Command and Control
Impact
T1486Data Encrypted for Impact
Royal ransomware encrypted files on systems with the .royal extension.
Recent victims
No victims tracked yet.