MITRE ATT&CKsoftware (malware)
S1073 Royal
- Domain
- enterprise
- Platforms
- Windows, ESXi
- Version
- 1.2
- Created
- 2023-03-30
Description
Royal is ransomware that first appeared in early 2022; a version that also targets ESXi servers was later observed in February 2023. Royal employs partial encryption and multiple threads to evade detection and speed encryption. Royal has been used in attacks against multiple industries worldwide--including critical infrastructure. Security researchers have identified similarities in the encryption routines and TTPs used in Royal and Conti attacks and noted a possible connection between their operators.
Related
Uses · MITRE ATT&CK (15)
- T1680 Local Storage Discovery technique
- T1059.012 Hypervisor CLI sub-technique
- T1566 Phishing technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1016 System Network Configuration Discovery technique
- T1046 Network Service Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1106 Native API technique
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a CISA Royal AA23-061A March 2023
- https://www.cybereason.com/blog/royal-ransomware-analysis Cybereason Royal December 2022
- https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive Kroll Royal Deep Dive February 2023
- https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html Trend Micro Royal Linux ESXi February 2023
- https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/ Microsoft Royal ransomware November 2022