{"id":76038,"date":"2023-01-22T09:00:43","date_gmt":"2023-01-22T17:00:43","guid":{"rendered":"https:\/\/forescoutstage.wpengine.com\/?p=76038"},"modified":"2023-01-24T06:09:24","modified_gmt":"2023-01-24T14:09:24","slug":"royal-ransomware-analysis-of-one-of-the-most-active-ransomware-groups","status":"publish","type":"post","link":"https:\/\/www.forescout.com\/blog\/royal-ransomware-analysis-of-one-of-the-most-active-ransomware-groups\/","title":{"rendered":"Royal Ransomware \u2013 Analysis of One of the Most Active Ransomware Groups in Late 2022 and Early 2023"},"content":{"rendered":"

In our new threat briefing report<\/a>, Forescout\u2019s Vedere Labs analyzes the Royal ransomware threat actor group and encryptor payload, presents threat hunt opportunities for network defenders and shares details of the group\u2019s tactics, techniques, and procedures (TTPs).<\/p>\n

Who is Royal ransomware?<\/h2>\n

The Royal ransomware threat actor group, initially tracked as DEV-0569, first emerged in early 2022 and has been especially active since the end of the same year. Royal ransomware was first observed by security researchers in September 2022 and since then multiple attacks were detected, targeting organizations across the globe, but mostly in the U.S., Brazil and Europe. It was among the most active ransomware groups<\/a> in December 2022 and has already announced its first victim of 2023: DSBJ, a Chinese company that manufactures components for Internet of Things (IoT) and telecommunications equipment.<\/p>\n

Security researchers have noticed<\/a> that the group was probably created by one of the former Conti teams (\u201cConti Team One\u201d) and used the Zeon encryptor in some attacks.<\/p>\n

Royal ransomware tactics, techniques and procedures<\/h2>\n

The group employs the double extortion tactic by gaining access to a victim\u2019s environment, encrypting their data, exfiltrating sensitive data and demanding a ransom to decrypt files. The files are encrypted using the Advanced Encryption Standard (AES) and given the extension .royal<\/strong>. In recent attacks, the encrypted files also had the extension .royal_*<\/strong>.<\/p>\n

The initial attack vectors are specifically designed and tailored for individual targets. They include:<\/p>\n