Rewterz Threat Alert – Royal Ransomware – Active IOCs

Severity

High

Analysis Summary

Royal ransomware is a new and increasingly active ransomware strain that has been causing havoc in the U.S. since its initial discovery in 2022. It is believed to be a highly experienced operation due to the use of unusual techniques to breach networks before encrypting them with malware and demanding ransom payments. The attacker gains access to the victim’s device or network through methods such as phishing emails, exploiting vulnerabilities, social engineering, or lateral movement. Once the attacker has encrypted the files, they demand a ransom payment, usually in the form of cryptocurrency.

The behavior of Royal Ransomware can vary depending on the specific version of the malware and the tactics used by the attackers. Some versions of the malware may target specific types of files, such as documents, images, and videos, while others may target the entire hard drive. The attackers may also use social engineering tactics to trick the victim into paying the ransom, such as creating a sense of urgency or threatening to delete the encrypted files if the ransom is not paid.

Royal Ransomware is a serious threat to individuals and organizations, as it can result in the loss of valuable data and disruption to normal business operations. To protect against Royal Ransomware and other similar threats, it is recommended that individuals and organizations implement a robust cybersecurity program, including regular software updates, anti-malware protection, and employee training on the dangers of phishing and social engineering.

Impact

• File Encryption

Indicators of Compromise

MD5

• 2902e12f00a185471b619233ee8631f3

SHA-256

• b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c

SHA-1

• 7e7f666a6839abe1b2cc76176516f54e46a2d453

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders