The rise of ransomware attacks has caused significant concerns for organizations worldwide. Among the notorious groups, the Royal ransomware group has emerged as a prominent threat actor, impacting over 350 global victims since September 2022. Their demands for hundreds of millions in ransom payments have put various industries on edge. In this article, we will delve into the workings of the Royal group, analyzing their methods, tools, and impact on targeted sectors.
Updated Cybersecurity Advisory
To combat the evolving threat landscape, a revised cybersecurity advisory has been released, incorporating new information and insights since the initial report in March 2023. The updated advisory includes refreshed indicators of compromise (IOCs) and details on the group’s tactics, techniques, and procedures (TTPs). This information aims to provide organizations with the necessary knowledge to detect and defend against attacks.
Tools and Techniques Used by Threat Actors
The Royal Group’s tactics involve utilizing a variety of tools and techniques to gain unauthorized access and exploit vulnerabilities. They have been observed employing open-source network tunneling tools like Chisel and Cloudflared. Additionally, they leverage the use of Secure Shell (SSH) clients such as OpenSSH and MobaXterm to establish SSH connections.
Furthermore, analysis of victim systems has revealed the presence of credential stealing tools like Mimikatz and password harvesting tools from Nirsoft. The Royal group’s reliance on legitimate remote access tools like AnyDesk, LogMeIn, and Atera Agent as backdoor access vectors poses a significant challenge for organizations seeking to identify and mitigate their activities.
Methods of initial access
Understanding how the Royal group gains initial access is crucial for preventing their attacks. Phishing remains their primary method, accounting for approximately two-thirds of their incidents. With carefully crafted emails, they trick unsuspecting victims into unknowingly downloading ransomware onto their systems.
Moreover, the Royal group frequently exploits Remote Desktop Protocol (RDP) compromises, gaining unauthorized access to systems with weak security controls. Although accounting for only 13% of incidents, RDP compromises remain a significant avenue for their successful attacks.
Lateral Movement Techniques
Once inside a victim’s network, the Royal group employs various techniques to move laterally, increasing their control and access. RDP and PsExec are frequently utilized by the group to navigate through the network, compromising additional systems and escalating their privileges.
Understanding the specific techniques employed by the Royal Group allows organizations to strengthen their security measures, ensuring that lateral movement is effectively detected and halted.
Data Aggregation and Exfiltration
To facilitate their operations, the Royal group deploys tools such as Cobalt Strike and malware like Ursnif/Gozi. These tools assist in aggregating and exfiltrating critical data from victim systems. Cobalt Strike enables the group to establish persistence, command-and-control communication, and perform reconnaissance, while Ursnif/Gozi act as data-stealing malware.
By gaining insights into the methods employed by the Royal Group for data aggregation and exfiltration, organizations can enhance their defenses by focusing on identifying and mitigating these specific threats.
Targeted sectors
The Royal Group indiscriminately targets organizations across various industries, with specific sectors experiencing a higher frequency of attacks. The healthcare, manufacturing, and education sectors have become prime targets due to their reliance on confidential patient data, intellectual property, and personal information.
Understanding the sectors most at risk allows organizations to prioritize their cybersecurity efforts, implement robust defenses, and raise awareness within these industries.
Ransom Demands
The Royal group’s motives ultimately revolve around financial gain, demanding substantial ransom payments in bitcoin to release encrypted data. Their ransom demands have ranged from around $1 million to $11 million. These exorbitant sums place significant financial strain on organizations, making it imperative to develop robust cybersecurity measures to prevent or mitigate attacks.
The Royal ransomware group’s relentless attacks have highlighted the pressing need for organizations to bolster their cybersecurity practices. By studying their tactics, techniques, and procedures, as well as understanding the sectors they frequently target, organizations can better fortify their defenses against the ever-evolving threat landscape. Implementing robust security measures, conducting regular security audits, and fostering a culture of cyber awareness will be crucial in minimizing the risk posed by groups like the Royal ransomware group and protecting valuable data from their clutches.