Loading threat actor…
Royal is a financially motivated ransomware operation active since approximately September 2022 and associated with large-scale double-extortion intrusions against organizations in the United States and internationally. The group is known for stealing data before encrypting systems and threatening publication on a leak site if victims do not pay. U.S. government reporting has linked Royal to hundreds of victims worldwide and ransom demands totaling hundreds of millions of dollars. Royal has also been assessed as having evolved from earlier activity involving the Zeon loader, and later reporting noted coding similarities between Royal and BlackSuit, suggesting a rebrand or spinoff relationship. Royal commonly gains initial access through phishing, including malicious documents and malvertising, and has also been observed using compromised RDP access, exploitation of public-facing applications, and access obtained through brokers using stolen VPN credentials. After access, the operators use legitimate remote administration and tunneling tools, conduct lateral movement with RDP and PsExec, and establish persistence through remote monitoring and management software. They have used valid accounts in some cases, including administrative access to domain controllers. The group demonstrates mature post-compromise tradecraft. Royal operators disable or weaken defenses, including modifying Group Policy to deactivate antivirus protections, delete logs, and inhibit recovery by removing shadow copies. They exfiltrate data with repurposed offensive tooling and then deploy a custom ransomware encryptor that supports partial encryption to accelerate impact and reduce the chance of early detection. Victim communications are handled through anonymity-network infrastructure rather than embedding full payment instructions in the initial ransom note. Royal has targeted multiple sectors, including manufacturing, communications, healthcare, and education, and has been associated with attacks against critical infrastructure organizations. Known aliases and related designations include DEV-0569, while BlackSuit has been reported to share coding characteristics with Royal.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.