Royal

Description

Royal is a ransomware operation staffed by experienced affiliates, some from the Conti network, that gained attention through high value extortion demands. Its operators favor callback phishing to establish contact, deploy custom tooling, and encrypt Windows and Linux systems, and they added support for VMware ESXi virtual machines as their campaigns matured. The brand later rebranded, illustrating how ransomware crews rotate names while preserving infrastructure and tactics.

Stats

First seen: November 2022
Last seen: October 2026

MITRE ATT&CK techniques

15 techniques across 6 tactics.

TA0001 Initial Access

T1566Phishing

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.012Hypervisor CLI
T1106Native API

TA0007 Discovery

T1016System Network Configuration Discovery
T1046Network Service Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1680Local Storage Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0011 Command and Control

T1095Non-Application Layer Protocol

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

Alert name variants

Alert Name	Engine
DeepScan:Generic.Ransom.Royal.CMD.A.FFFFFFFE	AV
Dump:Generic.Ransom.Royal.CMD.A.FFFFFFFE	ATP Sandbox Adv. HeuristicsAV
Gen:Variant.Linux.Ransom.Royal.1	AV
Gen:Variant.Ransom.Royal.1	AV
Gen:Variant.Ransom.Royal.13	AV
Gen:Variant.Ransom.Royal.6	AV
Linux.Ransomware.Royal	ATP Sandbox Adv. Heuristics
Trojan.Linux.Ransom.Royal.AF	AV
Trojan.Linux.Ransom.Royal.EA	AV
Trojan.Ransom.Royal.A	AV
Win32.Ransomware.Royal	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Royal	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Ransomware.Royal variant outbound connection attempt	IPS-SWG
MALWARE-OTHER Win.Ransomware.Royal variant download attempt	IPS-SWG
MALWARE-OTHER Win.Ransomware.Royal variant helper script download attempt	IPS-SWG