Loading story…
A US city government suffered a ransomware-related disruption later claimed by the Royal ransomware group, with emergency services remaining available but computerized dispatch systems affected and some operational impacts reportedly lasting into early June. Researchers linked the incident to infrastructure and behaviors associated with Royal, a closed ransomware operation reportedly tied to former Conti members and known for targeting organizations through phishing, malvertising, and commodity malware.
SecurityScorecard said its review of NetFlow data and VirusTotal artifacts from March through early May found activity consistent with Royal tradecraft, including a malicious HTML lure resembling callback phishing, communications with QakBot-linked IP addresses, spam-associated infrastructure, and extensive connections to LogMeIn remote-access services. Separate analysis of Royal ransomware has described the group’s broader tactics, techniques, and procedures, including use of initial-access malware such as BATLOADER and QakBot, helping place the city attack within a wider pattern of Royal intrusions and ransomware deployment.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A malicious HTML file containing JavaScript and an image from the city government domain appeared in VirusTotal. Researchers said the city-branded image suggested an impersonation attempt, and some detections linked the file to callback-phishing-like behavior.
A city mailserver IP address communicated seven times with spam-linked IP addresses across two days. SecurityScorecard cited this as part of the activity surrounding the incident.
The group rebranded from Zeon to Royal. The report also notes Royal is reportedly composed of former Conti members and is considered a closed group rather than a ransomware-as-a-service operation.
The ransomware group later known as Royal first surfaced under the name Zeon. The report describes this as the group's initial appearance before its later rebrand.
Some operational impacts from the city government ransomware incident appear to have lasted until June 5. Emergency services remained available despite the disruption to computerized dispatching systems.
City spokespeople confirmed reports of the ransomware-related attack. The ransom note reportedly claimed data theft and threatened publication of the stolen data.
Local media reported that a city government suffered a disruption from an attack claimed by the Royal ransomware group. The incident affected computerized dispatching systems, though emergency services remained available.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026
The City of Dallas said the **Royal** ransomware gang gained access to municipal systems on April 7, 2023, spent weeks conducting surveillance, and exfiltrated about **1.17 TB** of data before launching ransomware at 2 a.m. on May 3. The attack damaged hundreds of servers and more than a thousand endpoint devices, disrupting critical city operations including public safety dispatch, with police and ambulances reportedly sent to incorrect locations. Dallas activated its incident response plan, brought in outside cybersecurity firms, and coordinated with the **FBI** and **CISA**; more than 90% of affected services were restored within 18 days, and the city later approved **$8.5 million** for recovery and breach-notification work. Reporting on the incident said the intrusion exposed longstanding technical debt inside city systems, including outdated and unsupported software that increased risk despite recent gains in cybersecurity staffing and spending. The disruption echoed earlier ransomware damage in Atlanta, where city networks were hobbled by an attack linked to **SamSam**, forcing widespread shutdowns and recovery efforts with federal and private-sector assistance. Together, the incidents show how major U.S. municipalities remain high-value ransomware targets when internet-facing systems, patching gaps, and legacy infrastructure leave essential public services vulnerable.
Jun 29, 2026
Baltimore city government was hit by a **RobbinHood** ransomware attack that forced officials to shut down most servers, disrupted operations across roughly 10,000 government computers, and knocked multiple public services offline. City employees lost access to email, phones, billing systems, and administrative tools, while residents were unable to make online payments for water bills, property taxes, and parking tickets. Emergency services including **911** and **311** remained operational, but departments such as Public Works, Police, and Transportation were pushed to manual workarounds as federal investigators examined the intrusion. The attackers reportedly demanded **3 Bitcoin per department** or **13 Bitcoin** for the entire city, with the price set to rise after several days and files allegedly becoming unrecoverable after 10 days. Baltimore refused to pay, and the outage stretched for at least two weeks, making it the city’s second major cyber disruption in little more than a year after an earlier attack affected the 911 system. The incident became a prominent example of how ransomware can paralyze municipal government services and delay routine civic operations.
Jun 29, 2026