⚠️ Overview

Royal Ransom is a human-operated ransomware family first observed in early 2022, emerging as a distinct threat following the shutdown of the Conti ransomware operation. It is operated by a financially motivated cybercriminal group tracked as Royal or TeamRoyal, which employs a ransomware-as-a-service (RaaS) model but maintains tight control over encryption keys and negotiations. The malware is classified as a data-encrypting ransomware, often combined with data exfiltration for double-extortion tactics.

🔧 Technical Capabilities

Royal Ransom typically gains initial access via phishing emails, exploitation of internet-facing vulnerabilities (e.g., CVE-2018-13379 in Fortinet VPN, CVE-2021-26084 in Atlassian Confluence), or through compromised Remote Desktop Protocol (RDP) connections. Once inside, it uses native Windows tools like PowerShell, PsExec, and Cobalt Strike or Sliver beacons for lateral movement and privilege escalation. The ransomware employs a unique intermittent encryption technique, encrypting only partial blocks of files to evade detection and speed up the process, while leaving Critical system files untouched to maintain system stability. Persistence is achieved via scheduled tasks or registry run keys, and the malware disables backup services, Volume Shadow Copy (VSS), and antivirus processes using tools like GMER or IObit Unlocker. C2 communication is conducted over HTTPS using custom domains and IPs, often proxied through bulletproof hosting services.

📜 History & Notable Incidents

Royal Ransom first appeared in March 2022, with early victims in the healthcare and education sectors. In December 2022, the group attacked the Dallas Central Appraisal District (DCAD), exposing sensitive property and taxpayer data. A joint advisory from CISA and the FBI (AA23-022A) released in February 2023 highlighted Royal’s attacks on U.S. hospitals, including a 2022 breach of Mercy Medical Center in Oregon that disrupted patient care. The group has also targeted manufacturing and government entities across the United States, Canada, and Europe.

🔍 Detection Indicators

Known indicators include file encryption with the extension .royal or .crypt, and ransom notes named “!ReadMe_Royal.txt”. Behavioral signatures include the presence of the legitimate tool AnyDesk or Splashtop used for remote access, and execution of scripts like rs.bat or clean.bat. Network IOCs include communication with IP ranges such as 45.14.224.0/22 and 185.165.29.0/24, and user-agent strings like “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. Registry persistence is often set under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with key names like “RoyalUpdate” or “OneDriveSetup”.

☠️ Risk & Impact

Royal Ransom causes severe operational disruption by encrypting critical files across network shares and databases, leading to prolonged downtime and financial losses averaging over $1 million per incident (based on FBI IC3 reports). The group engages in data exfiltration prior to encryption, threatening to leak stolen data on a dedicated leak site unless ransom payments are made. Affected sectors include healthcare, education, manufacturing, and state and local government, with sensitive patient records, intellectual property, and citizen data at risk of exposure.

🛡️ Mitigation

Defensive measures include implementing multi-factor authentication for RDP and VPN, patching known vulnerabilities (particularly in Fortinet and Confluence), and enabling robust endpoint detection and response (EDR) tools with behavioral rules for intermittent encryption. Organizations should maintain offline backups, deploy YARA rules for Royal’s encryption patterns (e.g., partial block size of 0x2000 bytes), and follow the CISA-Mandiant joint advisory (AA23-022A) for indicator-based blocking. Regular user awareness training against phishing is also essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.