This new Royal ransomware is already asking for millions

Ransomware
(Image credit: Pixabay)

A brand new ransomware operator has been discovered active in the wild, and even though it’s a new entrant, it’s already demanding major ransom payments. 

A new report from BleepingComputer together with cybersecurity intelligence firm AdvIntel has analyzed the group’s activities, its encryptor, and its methodology.

Apparently, the group is made up of experienced ransomware actors that came from other operations. They joined forces in January this year, and don’t work as a RaaS, but rather as a private group with affiliates. At first, the group used other criminals’ encryptors, namely BlackCat, but soon pivoted to proprietary solutions. The first such encryptor is called Zeon. 

Starts with a phish

Earlier this month, the group rebranded from Zeon to Royal, using that name both in the ransom note, and as the file extension for encrypted documents.

The MO is nothing out of the ordinary: the attackers would first send a phishing email and urging the victims to call them back. On the call, the attackers would convince the victims to install remote access software and grant the attackers access to the endpoint. After that, the attackers would spread out across the network, map out and exfiltrate sensitive data, and encrypt all devices found on the network. 

The victims would then find a ransom note, README.TXT, in which they’d get a Tor link where they can engage in negotiations with the attackers. Allegedly, Royal asks anywhere between $250,000 and $2 million for the decryption key. During the negotiations, the attackers would decrypt a few files to show their program works, and show the list of files they’d release to the internet if the demands aren’t met. 

So far there are no reports of any victims actually paying for the decryption key, so it is impossible to know just how successful the group is. Royal’s leak site is yet to be found.

Via: BleepingComputer

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag
China government-linked hackers caught running a seriously dangerous ransomware scam
A person at a laptop with a cybersecure lock symbol floating above it.
Cybercrime gang targets victims with "triple threat" attacks
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
More reports claim 2024 was the worst year for ransomware attacks yet
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Less than half of ransomware incidents end in payment - but you should still be on your guard
Image of laptop infected with malware
Ransomware criminals are now sending their demands...by snail mail?
Ransomware attack on a computer
Ransomware attacks surged in 2024 as hackers looked to strike faster than ever
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Three iPhone 16 handsets on show
Apple could launch an iPhone 17 Ultra this year – but we've heard these rumors before
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough
Ray-Ban smart glasses with the Cpperni logo, an LED array, and a MacBook Air with M4 next to ecah other.
ICYMI: the week's 7 biggest tech stories from Twitter's massive outage to iRobot's impressive new Roombas
Brad Pitt looks over his right shoulder with 'F1' written behind him
Apple Original Films will take you behind-the-scenes of a racing cockpit in this new thrilling F1 movie trailer
AI writer
Coding AI tells developer to write it himself
Reacher looking down at another character from the Prime Video TV series Reacher
Reacher season 3 becomes Prime Video’s biggest returning show thanks to Hollywood’s biggest heavyweight