Royal Ransomware Disrupted US City Government Systems
Threat Actor Intelligence · 2 sources · Updated 2mo ago · First seen Mar 10, 2026
A US city government suffered a ransomware-related disruption later claimed by the Royal ransomware group, with emergency services remaining available but computerized dispatch systems affected and some operational impacts reportedly lasting into early June. Researchers linked the incident to infrastructure and behaviors associated with Royal, a closed ransomware operation reportedly tied to former Conti members and known for targeting organizations through phishing, malvertising, and commodity malware.
SecurityScorecard said its review of NetFlow data and VirusTotal artifacts from March through early May found activity consistent with Royal tradecraft, including a malicious HTML lure resembling callback phishing, communications with QakBot-linked IP addresses, spam-associated infrastructure, and extensive connections to LogMeIn remote-access services. Separate analysis of Royal ransomware has described the group’s broader tactics, techniques, and procedures, including use of initial-access malware such as BATLOADER and QakBot, helping place the city attack within a wider pattern of Royal intrusions and ransomware deployment.
