Loading story…
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former Conti members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached $25 million in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, FRwL / UAC-0118, and earlier ex-Conti-linked operations, including shared IPs and a Cobalt Strike watermark associated with related campaigns.
Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed RDP, and compromised credentials. After entry, the actors have used BATLOADER, Qakbot, Bokbot, Cobalt Strike, PsExec, PowerShell, AdFind, NetScan, Chisel, Rclone, PCHunter, PowerTool, and Process Hacker to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/ESXi ELF variant. Royal typically encrypts local drives and network shares, appends the .royal extension, deletes shadow copies, disables security services, and leaves README.txt ransom notes with Tor-based contact instructions. Defenders are urged to prioritize software patching, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
As of 10 January 2023, Royal actors claimed to have compromised at least 70 organizations worldwide. ACSC cited this as part of the group's expanding global activity.
Unit 42 reported that Royal later publicized attacks on 26 additional manufacturing organizations in 2023. The report also said Royal's leak site had claimed 157 victim organizations since 2022.
The U.S. Department of Health and Human Services warned about the threat Royal poses to the healthcare sector in January 2023. Unit 42 said the group had already impacted multiple healthcare organizations since its emergence.
The IP address 94.232.41.105 was identified as a Royal tool repository in December 2022. Analysis said it hosted separate Cobalt Strike instances tied to softloadup.com and later sombrat.com, both using watermark 206546002.
A CISA cybersecurity advisory on Royal included indicators of compromise and technical details, including IP address 139.60.161.213 associated with activity in November 2022. The same IP was also listed by CERT-UA in its FRwL/UAC-0118 advisory.
Royal ransomware was first observed in September 2022. Reporting also linked the group to the earlier Zeon ransomware family and described it as operating privately rather than as a RaaS model.
Royal's leak site listed 14 manufacturing organizations as impacted during 2022. Unit 42 cited this as evidence of the group's focus on critical infrastructure sectors.
In 2022, Royal ransomware actors targeted Australian critical infrastructure, including an educational institute. ACSC also noted increased domestic and global Royal activity during 2022.
Palo Alto Networks Unit 42 published a threat assessment describing Royal's tradecraft, victim sectors, extortion methods, and Linux/ESXi ELF variant. The report said responders had handled 15 Royal-related cases in the prior nine months.
Walmart Global Tech published analysis highlighting overlaps between Royal ransomware activity and CERT-UA's UAC-0118/FRwL cluster, including shared IPs and Cobalt Strike watermark 206546002. The article also assessed Somnia as a wiper rather than recoverable ransomware.
Australia's ACSC published an advisory profiling Royal ransomware, describing its victimology, double-extortion tactics, initial access methods, tooling, and recommended mitigations. The advisory said Royal activity seen in 2022 was continuing into 2023.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcemedium.com
Open sourcecyber.gov.au
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
Jun 29, 2026
The **BianLian** ransomware group increased its operational tempo and rapidly expanded its command-and-control infrastructure, with researchers linking the activity to a relatively new threat actor using custom **Go-based** malware, including a backdoor and encryptor. The group had been active since late 2021 and, by early September 2022, had posted **20 victims** to its leak site, underscoring its use of **double extortion**. Victims were concentrated in **North America, the UK, and Australia**, while targeting spanned sectors including **manufacturing, healthcare, and education**, with manufacturing receiving particular attention. Investigators said BianLian commonly gained initial access by exploiting the **ProxyShell** vulnerability chain, targeting **SonicWall VPN** devices, and attempting to use weak or exposed remote-access credentials. Once inside, the operators relied heavily on living-off-the-land techniques such as **RDP**, **WinRM**, **WMI**, **PowerShell**, `net.exe`, `netsh.exe`, and `reg.exe` for reconnaissance, lateral movement, and persistence, before turning more aggressive during encryption by disabling or bypassing defenses including **Windows Defender**, **AMSI**, and **Sophos** protections. Researchers assessed the group as technically capable at network intrusion and stealthy expansion, but comparatively immature in extortion operations due to operational mistakes and unreliable victim communications.
Aug 15, 2026
Researchers linked **Batloader** activity to the **Water Minyades / DEV-0569 / SteelClover** ecosystem, which used malvertising, SEO poisoning, and fake software download pages to lure victims into installing trojanized packages. The campaigns abused legitimate installer frameworks such as **Advanced Installer** and **WiX**, then shifted to obfuscated JavaScript and PyArmor-protected Python loaders that fingerprinted hosts, contacted command-and-control infrastructure, escalated privileges, and attempted to disable security tools. Operators also used cloned software sites and malicious Google ads to distribute MSI files that launched PowerShell, added Microsoft Defender exclusions, and retrieved encrypted follow-on payloads. The infections were used to selectively deploy a broad set of malware, including **Qakbot**, **Ursnif**, **Vidar**, **ZLoader**, **RedLine Stealer**, **Raccoon Stealer**, **Cobalt Strike**, and remote-management tools such as **Atera** and **Syncro**. Trend Micro reported that Batloader infections observed from September 2022 onward were associated with **Royal ransomware**, while NTT documented a surge of related infections at Japanese companies in early 2023 through the **FakeGPG** and **BatApp** campaigns. The activity was concentrated heavily in the United States but also affected Canada, Germany, Japan, and the United Kingdom, underscoring Batloader's role as a flexible initial-access platform for both credential theft and ransomware intrusion chains.
Aug 15, 2026