Royal Inactive
Operated without a RaaS model, using callback phishing and Batloader for initial access. Rebranded to BlackSuit.177
Total Victims
2022-09-01
First Seen
2023-05-28
Last Seen
15
Known TTPs
14.2d
Avg Delay
12
Negotiations
ONION URLS
royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion
royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion
TOOLS
AnyDesk
Sliver C2
nltest
PowerShell Empire
FILE EXTENSIONS
.xxx
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
| Date | Victim Name | Country | Sector | Status |
|---|---|---|---|---|
| 2023-05-28 | Spectrum & United Technologies | United Kingdom | Manufacturing | Removed |
| 2023-05-28 | North Engineering LLC | United States | Healthcare | Published |
| 2023-05-26 | IntegralTools | United States | Manufacturing | Published |
| 2023-05-25 | Sapphire Associates | United Kingdom | Agriculture | Published |
| 2023-05-23 | Stone Transport LLC | Croatia | Financial Services | Published |
| 2023-05-22 | Wind Services | Hungary | Agriculture | Published |
| 2023-05-21 | Peak Bank GmbH | United States | Technology | Published |
| 2023-05-14 | Pioneer & North Tools | Netherlands | Insurance | Published |
| 2023-05-10 | TowerVentures | Germany | Education | Published |
| 2023-05-10 | Meridian Bridge | France | Manufacturing | Removed |
| 2023-05-10 | Riverside Build Ltd | United States | Manufacturing | Published |
| 2023-05-09 | Pro Life | United States | Media & Entertainment | Published |
| 2023-05-09 | ProgressiveDental | United States | Real Estate | Published |
| 2023-05-09 | Global Group Inc. | United States | Technology | Published |
| 2023-05-09 | Excel Auto Ltd | United States | Manufacturing | Published |
| 2023-05-08 | PremierHospital | Italy | Transportation | Removed |
| 2023-05-08 | Modern & Peninsula Motors | India | Energy | Removed |
| 2023-05-08 | River Place Inc. | Canada | Government | Removed |
| 2023-05-06 | Mid Group LLC | South Africa | Energy | Published |
| 2023-05-03 | PowerEnterprises | Indonesia | Utilities | Published |
| 2023-05-01 | Maple Resources | Spain | Education | Published |
| 2023-05-01 | Atlas Sciences GmbH | United States | Logistics | Published |
| 2023-04-23 | White Med GmbH | Costa Rica | Technology | Published |
| 2023-04-23 | White Wealth Inc. | United States | Financial Services | Published |
| 2023-04-20 | Nova Risk GmbH | Switzerland | Government | Published |
| 2023-04-19 | Northwest Group Inc. | Greece | Non-Profit | Published |
| 2023-04-18 | Union Products Ltd | United States | Financial Services | Published |
| 2023-04-17 | OnyxPharma | France | Professional Services | Removed |
| 2023-04-17 | Cross Therapeutics GmbH | Slovakia | Automotive | Published |
| 2023-04-12 | Western Services GmbH | United States | Government | Published |
| 2023-04-12 | Lake Dev Ltd | United States | Retail | Published |
| 2023-04-10 | Sovereign Telecom GmbH | Philippines | Professional Services | Removed |
| 2023-04-07 | White Financial Inc. | United States | Energy | Published |
| 2023-04-06 | Verde & Wolf Ventures | Lithuania | Education | Published |
| 2023-04-03 | Southern Water LLC | United States | Professional Services | Removed |
| 2023-04-03 | CoastalWealth | United Kingdom | Technology | Removed |
| 2023-04-01 | Legacy & Crown Associates | Israel | Legal | Published |
| 2023-03-25 | EuroAssociates | South Africa | Financial Services | Removed |
| 2023-03-22 | Pro Transport | India | Food & Beverage | Published |
| 2023-03-21 | Silver Dental LLC | Argentina | Healthcare | Published |
| 2023-03-19 | Pioneer Print LLC | Dominican Republic | Healthcare | Published |
| 2023-03-18 | Pioneer Pharma | France | Healthcare | Published |
| 2023-03-18 | Omni Marine | United States | Manufacturing | Published |
| 2023-03-16 | WillowNetworks | Puerto Rico | Transportation | Published |
| 2023-03-14 | Blue Digital | Canada | Government | Published |
| 2023-03-14 | North Group | United States | Professional Services | Published |
| 2023-03-14 | Premier Rail | Denmark | Professional Services | Published |
| 2023-03-13 | Pioneer Foods Ltd | Mexico | Legal | Published |
| 2023-03-13 | Red Steel Inc. | United States | Pharmaceuticals | Published |
| 2023-03-12 | Innovative & Green Packaging | United Kingdom | Logistics | Negotiating |
| 2023-03-10 | Innovative & Federal Wire | United Kingdom | Technology | Published |
| 2023-03-09 | Meridian Life Inc. | Colombia | Legal | Published |
| 2023-03-08 | CoreMining | Ireland | Agriculture | Published |
| 2023-03-07 | Cross Operations | Germany | Construction | Published |
| 2023-03-07 | Integral Power Ltd | United States | Professional Services | Published |
| 2023-03-06 | Pacific Storage LLC | United States | Manufacturing | Published |
| 2023-03-05 | Prime Cloud | United States | Healthcare | Negotiating |
| 2023-03-05 | West Motors GmbH | Austria | Utilities | Published |
| 2023-03-05 | Prime Cast GmbH | United States | Technology | Removed |
| 2023-03-04 | Synergy Aero | Portugal | Education | Published |
| 2023-03-02 | Empire Life LLC | United States | Manufacturing | Negotiating |
| 2023-03-01 | Phoenix Path GmbH | Sweden | Government | Published |
| 2023-03-01 | Excel Resources Inc. | Italy | Professional Services | Published |
| 2023-03-01 | Smart Info GmbH | United States | Legal | Published |
| 2023-02-28 | Stone Corp GmbH | United States | Energy | Published |
| 2023-02-23 | ShieldIndustries | Germany | Energy | Published |
| 2023-02-23 | Core Realty Ltd | United Kingdom | Manufacturing | Published |
| 2023-02-22 | Delta Homes | Peru | Manufacturing | Published |
| 2023-02-21 | Grand Sports | Lithuania | Logistics | Published |
| 2023-02-18 | Sunrise Products Inc. | Ecuador | Education | Removed |
| 2023-02-18 | Platinum & Crown Corp | United Kingdom | Financial Services | Published |
| 2023-02-14 | First Gen LLC | United Kingdom | Education | Removed |
| 2023-02-11 | True Comm LLC | Saudi Arabia | Hospitality | Published |
| 2023-02-09 | Global Force Ltd | United States | Financial Services | Published |
| 2023-02-08 | Trust & Imperial Telecom | Romania | Financial Services | Removed |
| 2023-02-07 | White & Pacific Mining | Japan | Media & Entertainment | Published |
| 2023-02-06 | Elite Info | United States | Education | Removed |
| 2023-02-06 | Mountain Plus GmbH | Canada | Government | Published |
| 2023-02-04 | Imperial Oil LLC | Mexico | Education | Published |
| 2023-02-01 | TrustRail | Australia | Energy | Published |
| 2023-01-26 | MeridianMaterials | Bulgaria | Manufacturing | Published |
| 2023-01-26 | Highland Farm Ltd | Guatemala | Construction | Negotiating |
| 2023-01-23 | NavigatorWorld | Korea, Republic of | Manufacturing | Published |
| 2023-01-23 | Shield Risk Inc. | Sweden | Telecommunications | Published |
| 2023-01-21 | Metro Mechanical Inc. | Israel | Technology | Removed |
| 2023-01-21 | Diamond Motors | Guatemala | Technology | Removed |
| 2023-01-18 | Strategic Build Ltd | Malaysia | Professional Services | Negotiating |
| 2023-01-18 | Innovative Works GmbH | Panama | Energy | Published |
| 2023-01-18 | Sun Bio | Netherlands | Technology | Published |
| 2023-01-16 | Lake Digital Ltd | Guatemala | Technology | Published |
| 2023-01-16 | Sierra Finance LLC | Indonesia | Education | Published |
| 2023-01-15 | GlobalChem | New Zealand | Energy | Published |
| 2023-01-10 | Sunrise Wave GmbH | New Zealand | Food & Beverage | Published |
| 2023-01-10 | Allied Engineering Ltd | Peru | Transportation | Published |
| 2023-01-09 | Rapid Ware GmbH | France | Manufacturing | Published |
| 2023-01-08 | VitalSciences | United Kingdom | Financial Services | Removed |
| 2023-01-06 | Sage Group | Sweden | Construction | Published |
| 2023-01-05 | Phoenix Tech Inc. | Switzerland | Professional Services | Published |
| 2023-01-05 | Genesis Technologies Inc. | Brazil | Media & Entertainment | Published |
| 2023-01-03 | Vital Resources | Canada | Mining | Published |
| 2023-01-02 | Mountain & Vital Electric | Germany | Pharmaceuticals | Removed |
| 2023-01-01 | Envision Tech Ltd | United States | Healthcare | Published |
| 2022-12-22 | Pacific Ventures | United Kingdom | Construction | Published |
| 2022-12-17 | Frontier Management LLC | United Kingdom | Construction | Published |
| 2022-12-15 | Phoenix Metals | United Kingdom | Healthcare | Published |
| 2022-12-15 | Great Metals GmbH | Belgium | Retail | Published |
| 2022-12-15 | Modern Mobile GmbH | Taiwan, Province of China | Mining | Negotiating |
| 2022-12-15 | Apex Bridge GmbH | Argentina | Manufacturing | Removed |
| 2022-12-14 | Sierra & Iron Therapeutics | Germany | Government | Published |
| 2022-12-14 | Universal Source GmbH | United Kingdom | Technology | Published |
| 2022-11-28 | Meridian Packaging Ltd | Spain | Hospitality | Published |
| 2022-11-27 | Navigator Build Ltd | United Arab Emirates | Government | Published |
| 2022-11-27 | Riverside Data LLC | Netherlands | Healthcare | Published |
| 2022-11-26 | Trans Land Inc. | Israel | Legal | Published |
| 2022-11-25 | Rock Pharma | United States | Manufacturing | Published |
| 2022-11-24 | Pulse Group GmbH | United States | Manufacturing | Published |
| 2022-11-21 | Empire & River Electronics | United States | Telecommunications | Published |
| 2022-11-20 | Zenith Energy Inc. | United States | Manufacturing | Published |
| 2022-11-18 | Pro Force GmbH | United Kingdom | Retail | Published |
| 2022-11-17 | SunriseOperations | United Kingdom | Healthcare | Removed |
| 2022-11-14 | Sunrise Health | United States | Legal | Published |
| 2022-11-13 | Magna Land Inc. | Slovenia | Retail | Removed |
| 2022-11-08 | Rock Homes GmbH | Slovakia | Automotive | Published |
| 2022-11-08 | EnvisionPro | Argentina | Technology | Published |
| 2022-11-06 | Keystone Products Inc. | Venezuela, Bolivarian Republic of | Retail | Published |
| 2022-11-04 | Elite Enterprises Ltd | United States | Manufacturing | Published |
| 2022-11-04 | Elite & Prime Ware | Sweden | Government | Negotiating |
| 2022-11-03 | Strategic Sciences Inc. | Portugal | Pharmaceuticals | Published |
| 2022-11-01 | Solar Cloud Ltd | Germany | Financial Services | Published |
| 2022-11-01 | Lake Auto LLC | United States | Logistics | Published |
| 2022-10-27 | Star Materials Ltd | United States | Real Estate | Removed |
| 2022-10-27 | Sapphire Wealth Ltd | Netherlands | Non-Profit | Published |
| 2022-10-26 | Verde Motors Inc. | United States | Healthcare | Published |
| 2022-10-25 | Innovative Freight | Argentina | Transportation | Published |
| 2022-10-25 | Pulse Management LLC | Canada | Construction | Published |
| 2022-10-24 | Quest Systems Ltd | Croatia | Healthcare | Removed |
| 2022-10-23 | Solar & Highland Electric | Canada | Food & Beverage | Published |
| 2022-10-22 | Sage Vision GmbH | Belgium | Retail | Published |
| 2022-10-21 | East & City Trade | Switzerland | Technology | Negotiating |
| 2022-10-19 | Sun Trade GmbH | Denmark | Automotive | Removed |
| 2022-10-19 | Pulse Realty | United States | Professional Services | Published |
| 2022-10-19 | Zenith & Sterling Health | Israel | Non-Profit | Removed |
| 2022-10-19 | Central Packaging LLC | Türkiye | Insurance | Published |
| 2022-10-17 | Sky Tools Inc. | United States | Financial Services | Published |
| 2022-10-13 | InlandManagement | Ukraine | Manufacturing | Published |
| 2022-10-13 | Wind Tech LLC | United States | Hospitality | Published |
| 2022-10-09 | Legacy Place | United States | Real Estate | Published |
| 2022-10-09 | Inland & Capital Partners | United States | Technology | Published |
| 2022-10-07 | Peak & Horizon Motors | Canada | Financial Services | Published |
| 2022-10-07 | Spring Supply GmbH | Australia | Government | Published |
| 2022-10-06 | Federal Force GmbH | United Kingdom | Retail | Published |
| 2022-10-06 | Riverside Auto GmbH | Canada | Technology | Published |
| 2022-10-05 | Global Clinic LLC | United States | Legal | Published |
| 2022-10-04 | Solar Source Ltd | Germany | Telecommunications | Published |
| 2022-10-04 | Horizon Wire GmbH | United States | Retail | Published |
| 2022-10-01 | Diamond Logistics Inc. | United States | Education | Published |
| 2022-09-28 | Royal Defense Inc. | United States | Manufacturing | Removed |
| 2022-09-28 | Eagle Aero Inc. | France | Technology | Removed |
| 2022-09-27 | Nova & Ridge Enterprises | Argentina | Energy | Published |
| 2022-09-26 | PineWave | Ukraine | Education | Published |
| 2022-09-24 | Central Tools Ltd | Germany | Education | Published |
| 2022-09-23 | MountainHospitality | Singapore | Manufacturing | Published |
| 2022-09-23 | Solid Ship LLC | United States | Aerospace & Defense | Published |
| 2022-09-19 | Infinity Partners Ltd | Belgium | Transportation | Published |
| 2022-09-18 | Key Dynamics LLC | Italy | Manufacturing | Published |
| 2022-09-18 | Vanguard Cast Inc. | Luxembourg | Healthcare | Published |
| 2022-09-15 | Tri Farm GmbH | Singapore | Telecommunications | Published |
| 2022-09-12 | Modern & Highland Dev | Germany | Energy | Removed |
| 2022-09-10 | Strategic World | Poland | Media & Entertainment | Removed |
| 2022-09-09 | Wolf Storage Inc. | United States | Media & Entertainment | Published |
| 2022-09-07 | Empire & Horizon Transport | United States | Technology | Published |
| 2022-09-07 | Mountain & Wolf Foods | Ukraine | Financial Services | Removed |
| 2022-09-06 | Sapphire Connect | Costa Rica | Manufacturing | Published |
| 2022-09-06 | Liberty Mechanical LLC | United States | Healthcare | Removed |
| 2022-09-04 | Pro & Cross Care | United States | Education | Removed |
| 2022-09-04 | East Wealth | United States | Government | Negotiating |
| 2022-09-04 | Superior Pharma Ltd | Bulgaria | Real Estate | Published |
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1095 | Non-Application Layer Protocol | command-and-control |
| T1016 | System Network Configuration Discovery | discovery |
| T1046 | Network Service Discovery | discovery |
| T1057 | Process Discovery | discovery |
| T1082 | System Information Discovery | discovery |
| T1083 | File and Directory Discovery | discovery |
| T1135 | Network Share Discovery | discovery |
| T1680 | Local Storage Discovery | discovery |
| T1059.012 | Hypervisor CLI | execution |
| T1106 | Native API | execution |
| T1486 | Data Encrypted for Impact | impact |
| T1489 | Service Stop | impact |
| T1490 | Inhibit System Recovery | impact |
| T1566 | Phishing | initial-access |
| T1021.002 | SMB/Windows Admin Shares | lateral-movement |
No YARA rules
No IoCs
README.TXT
If you're reading this, it means that your system were hit by Royal ransomware.
Please contact us via :
http://royal[REDACTED].onion/{VICTIM_ID}
In the meantime, let us explain this case.
It may seem complicated, but it is really not. Most likely what happened was that
you decided to save some money on your security infrastructure.
Alas, as a result your critical data was not only encrypted but also copied from
your network on a secure server. From there it can be published online.
Then anyone on the internet from darknet criminals, ACLU journalists, Chinese
government(different APT groups), and even your employees will be able to see
your internal documentation: personal data of your employees, CV, SSN, their
bank accounts, complete financial data of your company, banking, tax returns.
Royal offers you a unique deal. For a modest royalty(got it?) for our pentesting
services we will not only provide you with an amazing risk mitigation service,
covering you from reputational, legal, financial, regulatory and insurance risks,
but will also provide you with a security review and recommendations.