Inactive ransomware operator
← All groupsRoyal
211 victims indexed · first seen 4 years ago · last activity 3 years ago
At a glance
- Status
- inactive
- First seen
- 4 years ago
- Last activity
- 3 years ago
- Onion sites
- 3 known endpoints
- Primary sector
- Education · 10 hits
About
References
1 linkExternal sources curated by the MISP threat-intel community.
Timeline
9 monthsTop countries
Top sectors
MITRE ATT&CK
46 techniques · 12 tacticsTactics
Techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1003.003NTDS
- T1003.004LSA Secrets
- T1005Data from Local System
- T1007System Service Discovery
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1020Automated Exfiltration
- T1021.002SMB/Windows Admin Shares
- T1027Obfuscated Files or Information
- T1033System Owner/User Discovery
- T1036.002Right-to-Left Override
- T1036.005Match Legitimate Resource Name or Location
- T1041Exfiltration Over C2 Channel
- T1049System Network Connections Discovery
- T1056.001Keylogging
- T1057Process Discovery
- T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1069.002Domain Groups
- T1071.001Web Protocols
- T1071.004DNS
- T1078Valid Accounts
- T1078.004Cloud Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1105Ingress Tool Transfer
- T1114.002Remote Email Collection
- T1119Automated Collection
- T1133External Remote Services
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1213.002Sharepoint
- T1543.003Windows Service
- T1547.001Registry Run Keys / Startup Folder
- T1558.001Golden Ticket
- T1560Archive Collected Data
- T1560.001Archive via Utility
- T1569.002Service Execution
- T1583.005Botnet
- T1587.001Malware
- T1588.002Tool
- T1614.001System Language Discovery
Detection · YARA rules
1 ruleRoyal_Ransomware
Detects Royal ransomware
source: CISA AA23-061A
Recent victims
Loading…
Onion infrastructure
3 known- http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion
- http://royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion
- http://royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion/api/posts/list
Source
Updated 3 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
