Rewterz Threat Alert – Royal Ransomware – Active IOCs

Severity

High

Analysis Summary

Royal ransomware is a new and increasingly active ransomware strain that has been causing havoc in the U.S. since its initial discovery in 2022. It is believed to be a highly experienced operation due to the use of unusual techniques to breach networks before encrypting them with malware and demanding ransom payments. The attacker gains access to the victim’s device or network through methods such as phishing emails, exploiting vulnerabilities, social engineering, or lateral movement. Once the attacker has encrypted the files, they demand a ransom payment, usually in the form of cryptocurrency.

The behavior of Royal Ransomware can vary depending on the specific version of the malware and the tactics used by the attackers. Some versions of the malware may target specific types of files, such as documents, images, and videos, while others may target the entire hard drive. The attackers may also use social engineering tactics to trick the victim into paying the ransom, such as creating a sense of urgency or threatening to delete the encrypted files if the ransom is not paid.

Royal Ransomware is a serious threat to individuals and organizations, as it can result in the loss of valuable data and disruption to normal business operations. To protect against Royal Ransomware and other similar threats, it is recommended that individuals and organizations implement a robust cybersecurity program, including regular software updates, anti-malware protection, and employee training on the dangers of phishing and social engineering.

Impact

• File Encryption

Indicators of Compromise

MD5

• 96140a68ba92a953508d3748f7e34e97

SHA-256

• 276c5840b1b66b6d1dd69be7f33c629e778b66e9db76370772fb691aeabc5ed4

SHA-1

• 2e6d92c19f95dafee2c41ac235c19a28884cff44

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.