Loading story…
The City of Dallas said the Royal ransomware gang gained access to municipal systems on April 7, 2023, spent weeks conducting surveillance, and exfiltrated about 1.17 TB of data before launching ransomware at 2 a.m. on May 3. The attack damaged hundreds of servers and more than a thousand endpoint devices, disrupting critical city operations including public safety dispatch, with police and ambulances reportedly sent to incorrect locations. Dallas activated its incident response plan, brought in outside cybersecurity firms, and coordinated with the FBI and CISA; more than 90% of affected services were restored within 18 days, and the city later approved $8.5 million for recovery and breach-notification work.
Reporting on the incident said the intrusion exposed longstanding technical debt inside city systems, including outdated and unsupported software that increased risk despite recent gains in cybersecurity staffing and spending. The disruption echoed earlier ransomware damage in Atlanta, where city networks were hobbled by an attack linked to SamSam, forcing widespread shutdowns and recovery efforts with federal and private-sector assistance. Together, the incidents show how major U.S. municipalities remain high-value ransomware targets when internet-facing systems, patching gaps, and legacy infrastructure leave essential public services vulnerable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The city approved $8.5 million to support ransomware recovery and breach notification efforts following the Royal attack. A later after-action report also cited technical debt, outdated systems, and unsupported software as factors that increased risk.
Within 18 days of the May 3 attack, Dallas had restored more than 90% of impacted services. The recovery followed major disruption to city operations caused by the Royal ransomware incident.
After the ransomware attack, Dallas activated its incident response plan and worked with external cybersecurity firms, the FBI, and CISA. The incident ultimately damaged hundreds of servers and more than a thousand endpoint devices, with about 1.17 terabytes of data exfiltrated.
Royal deployed ransomware against Dallas at about 2 a.m., disrupting critical municipal services. The attack affected public safety dispatch and contributed to police and ambulances being sent to incorrect locations.
According to a later after-action report, the Royal ransomware gang infiltrated Dallas municipal networks and began surveillance inside the environment. The attackers remained in the network for weeks before launching ransomware.
Atlanta officials said they were working continuously to recover from the attack with help from the FBI, the Department of Homeland Security, and private-sector partners. Investigators assessed the scope of the incident, and experts cited signs consistent with SamSam ransomware.
Atlanta's computer network was hit by a ransomware attack that encrypted some city data and disrupted numerous city applications. The city shut down many systems as a precaution, while emergency response systems, water safety, and airport operations were reported unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetheregister.com
Open sourcetherecord.media
Open sourcestatescoop.com
Open sourceapnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Baltimore city government was hit by a **RobbinHood** ransomware attack that forced officials to shut down most servers, disrupted operations across roughly 10,000 government computers, and knocked multiple public services offline. City employees lost access to email, phones, billing systems, and administrative tools, while residents were unable to make online payments for water bills, property taxes, and parking tickets. Emergency services including **911** and **311** remained operational, but departments such as Public Works, Police, and Transportation were pushed to manual workarounds as federal investigators examined the intrusion. The attackers reportedly demanded **3 Bitcoin per department** or **13 Bitcoin** for the entire city, with the price set to rise after several days and files allegedly becoming unrecoverable after 10 days. Baltimore refused to pay, and the outage stretched for at least two weeks, making it the city’s second major cyber disruption in little more than a year after an earlier attack affected the 911 system. The incident became a prominent example of how ransomware can paralyze municipal government services and delay routine civic operations.
Jun 29, 2026
The City of Coweta, Oklahoma said a ransomware attack caused a system-wide outage across city computers, files, and computer-based services, disrupting municipal operations while leaving the city website and a third-party online billing portal accessible. Officials said the intrusion affected city systems broadly, prompting an immediate response with the city's contracted IT provider and additional cybersecurity professionals to secure the environment, contain further intrusion, and begin recovery efforts. City officials said the Coweta Police Department and Fire Department were not affected because they operate through off-site systems, and emergency services including **911** remained operational throughout the incident. The city also said it has an **offsite backup** and plans to use it to restore data once systems are cleared and deemed safe for recovery.
Aug 10, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026