royal Ransomware
Tracked since Nov 4, 2022
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Persistence
T1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1078.002 Domain AccountsT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control Defense Evasion
T1027.006 Obfuscated Files or Information: HTML SmugglingT1055 Process InjectionT1078.002 Domain Accounts Discovery
T1087.001 Account Discovery: Local AccountT1087.002 Account Discovery: Domain AccountT1135 Network Share DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin SharesT1078.002 Valid Accounts: Domain AccountsT1550.002 Use Alternate Authentication Material: Pass the Hash Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071 Application Layer ProtocolT1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for Impact Observed tools
Credential Theft
Mimikatz · NirSoft Dialupass · NirSoft IEPassView (iepv) · NirSoft MailPassView · NirSoft Netpass · NirSoft RouterPassView
Defense Evasion
Eraser · GMER · NSudo · PowerTool
Discovery Enum
AdFind · Advanced IP Scanner · SharpShares · SoftPerfect NetScan
Exfiltration
RClone
LOLBAS
PsExec
Networking
Chisel · Cloudflared · OpenSSH
Offsec
Brute Ratel C4 · Cobalt Strike
RMM-Tools
AnyDesk · Atera · LogMeIn · MobaXterm · Syncro
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live