Loading malware…
Royal is a file-encrypting ransomware family associated with a financially motivated, Conti-linked criminal operation that subsequently operated under the BlackSuit name. Its attacks use double extortion, combining encryption of organizational systems with theft of sensitive information to pressure victims into paying. Royal has affected municipal government environments, while BlackSuit activity has also targeted education, industrial goods and services, and construction organizations, particularly in the United States.
Royal-associated intrusions involve compromised accounts, legitimate remote-management software, and penetration-testing tools to maintain access and move laterally. In the City of Dallas attack, operators accessed a server through a service account, harvested credentials, exfiltrated approximately 1.169 TB of data, and impaired hundreds of servers. Royal and BlackSuit operators have abused remote monitoring and management tools for persistence and detection evasion.
Documented BlackSuit attacks against Windows environments have involved valid-account access through a VPN without multifactor authentication, Kerberoasting and AS-REP roasting, compromise of privileged service accounts, and extraction of Active Directory credential material. Operators staged and compressed stolen data before transferring it externally, then distributed ransomware across hundreds of hosts using PsExec and SMB and executed it through Windows Management Instrumentation. A Windows virtual machine was used to conceal ransomware deployment from endpoint security controls. These activities demonstrate an enterprise-wide intrusion and extortion workflow rather than encryption confined to an initial endpoint.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
13 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The cumulative count of 1,398 endpoint devices went through reconstruction directly due to the effects of the Royal ransomware infection.
Also worked as an affiliate for “BlackSuit” (aka Royal) ransomware, another spinoff of Conti.
ShadowSyndicate "had been associated with the ALPHV/BlackCat, Cl0p, Royal, Play, Cactus, Nokoyawa, and Quantum ransomware operations."
On May 1, local media reported that a city government had suffered a disruption resulting from an attack claimed by the Royal ransomware group.
Executive Summary Royal ransomware has been involved in high-profile attacks against critical infrastructure, especially healthcare, since it was first observed in September 2022.
We have also seen Batloader being a key enabler for Royal ransomware, the second-most prevalent ransomware family we have been observing recently.
+7 more in the app. View in Mallory
27 distinct techniques documented for this family, organized by ATT&CK tactic.
one of the most common infection chains for Linux is exploiting a vulnerability in some exposed service of the victim’s servers. This is also true for vulnerabilities in ESXi, but there are also other cases, such as IceFire which exploits a vulnerability in an IBM technology (CVE-2022-47986)
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 ... T1059 ... Command and Scripting Interpreter
the use of the same batch scripts and files: file1.bat, file2.bat, ip.txt, and gp.bat
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 ... User Execution
Finally, the ransomware verifies whether the “delete” parameter is provided during execution. If this parameter is passed, it causes the ransomware to delete itself after completing the encryption process.
file1.bat : a batch file designed to set up the system with autologon as the newly-created administrative user AdminBac, reboot into Safe Mode ... file2.bat : a second batch file, executed in Safe Mode via a registry key, designed to unpack the ransomware binary from the encrypted archive
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... Discovery T1057 ... Process Discovery
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... T1082 ... System Information Discovery
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... T1083 ... File and Directory Discovery
"Babuk can enumerate disk volumes, get disk information"; "Ryuk has called GetLogicalDrives ... and GetDriveTypeW"; "Cuba can enumerate local drives, disk type, and disk free space"; "Chimera ... fsutil fsinfo drives"
After creating a new thread, the ransomware employs the NetShareEnum() API to obtain information about the available network shares on the local system.
Once it obtains the list of network shares, the ransomware establishes connections to the administrative (ADMIN$) and interprocess communication (IPC$) shares, enabling its lateral movement to infect other systems connected to the same network.
The group employs Royal and BlackSuit lockers, with Emotet and IcedID as precursors. They prioritize alternatives to CobaltStrike, particularly Sliver, and develop custom precursor loaders.
Zolotarjovs was specifically tasked with analyzing data stolen from victims, researching the companies and using the information to force victims into paying.
When the ransom demand was not met, he allegedly encouraged co-conspirators to leak or sell the data.
This group is known to perform double-extortion, where data is exfiltrated prior to encryption, and stolen data is publicly released via a leak site if an extortion demand is not met. | CDK Global ... experienced a significant operational disruption due to a ransomware attack executed by the BlackSuit ransomware group.
When the parameter “-vmsyslog” is passed, the ransomware is designed to terminate the “vmsyslog” service in the targeted machine.
BlackSuit ransomware also deletes shadow copies using the following command: "%System%\vssadmin.exe" Delete Shadows /All /Quiet
Finally, it initiates a system shutdown with the “shutdown.exe” utility and the arguments “/r /t 0”, which will restart the system immediately.
This group is known to perform double-extortion, where data is exfiltrated prior to encryption, and stolen data is publicly released via a leak site if an extortion demand is not met.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
144 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.