Royal Ransomware

Malware updated 4 days ago (2024-11-29T14:34:41.712Z)

Download STIX

Preview STIX

Royal Ransomware is a form of malware that was active from September 2022 through June 2023. This malicious software, designed to exploit and damage computers or devices, would infiltrate systems via suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it could steal personal information, disrupt operations, or hold data hostage for ransom. The encryption process used by this ransomware was multi-threaded, making it particularly potent. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) issued updates on the status of this threat during its active period. In May 2023, Royal Ransomware underwent a rebranding and emerged as BlackSuit Ransomware. This new variant shared numerous coding similarities with its predecessor but exhibited improved capabilities. Like Royal Ransomware, BlackSuit operated a dark web leak site where they published victims' names and stolen data, extorting them into paying a ransom. The group behind this threat, known as Ignoble Scorpius, is believed to include members from both Conti and Royal Ransomware operations. The FBI and CISA released an update in August 2024 that identified BlackSuit as the evolution of Royal Ransomware. This advisory provided network defenders with recent and historically observed tactics, techniques, procedures (TTPs), and indicators of compromise (IOCs) associated with both BlackSuit and legacy Royal activity. The FBI investigations identified the latest BlackSuit operations as recent as July 2024. As of the cut-off date of this summary, CISA, in partnership with the FBI, continues to monitor and provide updates on these cybersecurity threats.

Description last updated: 2024-11-21T10:27:23.866Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Blacksuit is a possible alias for Royal Ransomware. BlackSuit is a new strain of malware, specifically ransomware, that has been causing significant damage to computer systems. It is believed to be a rebranding of the Royal ransomware gang, as indicated by similarities in code between the two. This suspicion was confirmed by warnings from both the Cy	10
Blacksuit Ransomware is a possible alias for Royal Ransomware. The BlackSuit ransomware, a malicious software variant designed to encrypt and ransom victims' files, emerged in May 2023 as a direct evolution of the Royal ransomware. The group behind this threat, known as Ignoble Scorpius, was identified by Unit 42 Threat Intelligence, which also observed an incr	3
Hive is a possible alias for Royal Ransomware. Hive is a form of malware, specifically ransomware, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Hive can steal personal information, disrupt operations, or hold data hostag	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Malware

Ransom

Phishing

Windows

Linux

Malvertising

Encryption

Esxi

Encrypt

CISA

Antivirus

Extortion

Malware Drop...

Reconnaissance

Exploit

Spyware

Backdoor

Loader

Bitcoin

Malware Loader

Ransomware P...

Microsoft

Payload

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Conti Malware is associated with Royal Ransomware. Conti is a type of malware, specifically ransomware, which is designed to infiltrate and damage computer systems. This malicious software can enter systems through various methods such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal persona	is related to	7
The Batloader Malware is associated with Royal Ransomware. Batloader is a malware downloader posing as installers or updates for legitimate applications such as Microsoft Teams, Zoom, and others. This malicious software can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal	is related to	5
The Lockbit Malware is associated with Royal Ransomware. LockBit is a prominent ransomware-as-a-service (RaaS) malware that has been involved in numerous cyberattacks, demonstrating its staying power and adaptability. The malware, which can infiltrate systems through suspicious downloads, emails, or websites, is designed to exploit and damage computers or	Unspecified	5
The Blackbasta Malware is associated with Royal Ransomware. BlackBasta is a notorious malware group that has emerged as a significant player in the ransomware space. The group has demonstrated an ability to adapt and evolve their tactics, making them a leading entity in the Russian-language ransomware domain. Initially, BlackBasta was observed using a botnet	Unspecified	4
The QakBot Malware is associated with Royal Ransomware. Qakbot is a type of malware, or malicious software, that infiltrates computer systems to exploit and damage them. This harmful program can infect devices through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt ope	Unspecified	3
The IcedID Malware is associated with Royal Ransomware. IcedID is a malicious software (malware) that has been implicated in numerous cybercrime campaigns. It has been associated with other notable malware such as Qakbot, BazarLoader, CobaltStrike, Conti, Gozi, Trickbot, Quantum, Emotet, Pikabot, and SystemBC. Its distribution often involves the use of d	Unspecified	2
The Vidar Malware is associated with Royal Ransomware. Vidar is a malicious software (malware) that primarily targets Windows systems, written in C++ and based on the Arkei stealer. It has historically been favored by threat actors who sell logs through marketplaces like 2easy, alongside other infostealers such as Raccoon, RedLine, and AZORult. The malw	Unspecified	2
The Clop Malware is associated with Royal Ransomware. Clop, a malicious software (malware), is linked to a Russian-speaking cybercriminal group also known as Cl0p. It is designed to exploit and damage computer systems by stealing personal information, disrupting operations, or holding data hostage for ransom. In May 2023, the Clop group began exploitin	Unspecified	2
The Ghost Clown Malware is associated with Royal Ransomware. Ghost Clown is a malware entity that has been implicated in the deployment of malicious software, specifically ransomware strains like BlackBasta and Conti. This previously undetected ransomware group, along with another affiliate named Space Kook, were identified by anti-ransomware company Halcyon.	Unspecified	2
The TrickBot Malware is associated with Royal Ransomware. TrickBot is a notorious malware developed by cybercriminals to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. This malicious software can steal personal information, disrupt operations, or even hold data hostage for ransom. Vladimir Dunaev,	Unspecified	2
The Netsupport Manager Malware is associated with Royal Ransomware. NetSupport Manager is a malicious software (malware) that infiltrates systems through suspicious downloads, emails, or websites. Once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. The malware has been detected by InsightIDR Attacker Behavio	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Alphv Threat Actor is associated with Royal Ransomware. Alphv, also known as BlackCat, is a threat actor group that has been linked to numerous cyberattacks, particularly targeting the healthcare sector. The group made headlines when it stole 5TB of data from Morrison Community Hospital, causing significant disruption and raising concerns about patient p	Unspecified	3
The Conti Team Threat Actor is associated with Royal Ransomware. The Conti team, a threat actor group known for its malicious activities in the cyber realm, has seen significant developments and transformations over recent years. In September 2022, a splinter group from Conti Team One resurfaced under the name Royal Ransomware, conducting callback phishing attack	is related to	2
The Medusa Threat Actor is associated with Royal Ransomware. Medusa, a threat actor group known for its malicious activities, has been increasingly involved in multiple high-profile cyber attacks. In November 2023, Medusa and other groups like LockBit and ALPHV (BlackCat) exploited a zero-day vulnerability, the Citrix Bleed (CVE-2023-4966), leading to numerou	Unspecified	2
The Space Kook Threat Actor is associated with Royal Ransomware. Space Kook is a threat actor, or malicious entity, identified in the cybersecurity industry for its involvement in ransomware operations. Named after a villain from Scooby Doo, Space Kook was first linked to malicious activities by Halcyon's analysis, which showed connections to an initial access br	Unspecified	2
The Zeon Threat Actor is associated with Royal Ransomware. Zeon, a known threat actor in the cybersecurity landscape, has been linked to several high-profile ransomware attacks. It was instrumental in crypting SVCReady and CargoBay loaders, observed in Quantum and Royal ransomware attacks respectively. Zeon has also employed third-party ransomware such as B	Unspecified	2

Source Document References

Information about the Royal Ransomware Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Unit42	13 days ago	Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
BankInfoSecurity	3 months ago	Ransomware Hackers Steal Medical Insurance Data of 1M People
Securityaffairs	4 months ago	Security Affairs newsletter Round 484 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	FBI and CISA update a joint advisory on the BlackSuit Ransomware group
CISA	4 months ago	Royal Ransomware Actors Rebrand as “BlackSuit,” FBI and CISA Release Update to Advisory \| CISA
InfoSecurity-magazine	5 months ago	Indiana County Files Disaster Declaration Following Ransomware Attack
Securityaffairs	5 months ago	October ransomware attack on Dallas County impacted over 200K people
BankInfoSecurity	5 months ago	CDK Begins Restoring Systems Amid Ransomware Payment Reports
Checkpoint	5 months ago	24th June – Threat Intelligence Report - Check Point Research
DARKReading	6 months ago	CISO Corner: Federal Cyber Deadlines Loom; Private Chatbot Danger
DARKReading	6 months ago	BlackSuit Claims Dozens of Victims With Ransomware
BankInfoSecurity	7 months ago	Suspected Attack Shuts Down US Blood Plasma Donation Centers
Checkpoint	8 months ago	15th April – Threat Intelligence Report - Check Point Research
CERT-EU	2 years ago	There were more ransomware attacks last month than any other on record \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware – National Cyber Security Consulting
CERT-EU	9 months ago	Proactive Patching Translates into Less Ransomware Payouts - Cybersecurity Insiders
CERT-EU	9 months ago	Operation Cronos: Who Are the LockBit Admins
Unit42	10 months ago	Ransomware Retrospective 2024: Unit 42 Leak Site Analysis
DARKReading	10 months ago	A Cyber Insurer's Perspective on How to Avoid Ransomware
CERT-EU	10 months ago	Researchers link 3AM ransomware to Conti, Royal cybercrime gangs
CERT-EU	a year ago	A look back to plan ahead \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting