royal Ransomware
Monitorado desde 04/11/2022
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Persistence
T1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1078.002 Domain AccountsT1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control Defense Evasion
T1027.006 Obfuscated Files or Information: HTML SmugglingT1055 Process InjectionT1078.002 Domain Accounts Discovery
T1087.001 Account Discovery: Local AccountT1087.002 Account Discovery: Domain AccountT1135 Network Share DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin SharesT1078.002 Valid Accounts: Domain AccountsT1550.002 Use Alternate Authentication Material: Pass the Hash Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071 Application Layer ProtocolT1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for Impact Ferramentas observadas
Credential Theft
Mimikatz · NirSoft Dialupass · NirSoft IEPassView (iepv) · NirSoft MailPassView · NirSoft Netpass · NirSoft RouterPassView
Defense Evasion
Eraser · GMER · NSudo · PowerTool
Discovery Enum
AdFind · Advanced IP Scanner · SharpShares · SoftPerfect NetScan
Exfiltration
RClone
LOLBAS
PsExec
Networking
Chisel · Cloudflared · OpenSSH
Offsec
Brute Ratel C4 · Cobalt Strike
RMM-Tools
AnyDesk · Atera · LogMeIn · MobaXterm · Syncro
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live