A fresh advice advising system defenders against the Royal Ransomware gang has been released by the United States Cybersecurity and Infrastructure Security Agency (CISA).
The report, which was produced on Thursday in partnership with the FBI and is a part of the Agency’s #StopRansomware campaign, details the tactics, methods, and procedures (TTPs) as well as the indications of compromise (IOCs) connected with various ransomware variants.
A variation of the Royal ransomware has been used by cybercriminals to attack systems belonging to companies in the United States and other countries from roughly September 2022. The FBI and CISA both think that prior variants of the malware, which utilized “Zeon” as a loader, were the progenitors of current variety, which employs its own custom-made file encryption tool. When the actors behind Royal have gained access to the networks of their victims, the first thing they do is deactivate the victims’ antivirus software and steal a significant quantity of data before finally spreading ransomware and encrypting the computers. Several ransom demands have been made by royal actors, ranging from about one million to eleven million dollars US in Bitcoin. In the events that have been witnessed, the Royal actors have not included ransom sums or directions for making payments as part of the original ransom message. Instead, the letter that displays after encryption instructs victims that they must have direct communication with the malicious actor via the use of a.onion URL (reachable through the Tor browser). Many key infrastructure sectors have been targeted by hostile actors, including but not limited to manufacturing, communications, healthcare and public healthcare (HPH), and education.
According to the joint Cybersecurity Advisory (CSA), recent harmful behavior by threat actors utilizing a specific malware variant has been identified since September 2022. This information was gleaned via monitoring activity from the beginning of 2022.
According to the advice, the FBI and CISA “think that this variation developed from prior iterations that employed ‘Zeon’ as a loader.” “This variant employs its own custom-made file encryption tool,” the advisory said.
After first acquiring access to networks using phishing, remote desktop protocol (RDP, and other methods, the threat actors were spotted deactivating antivirus software on victims’ PCs and exfiltrating massive volumes of data. They eventually started using the malware, which encrypted the systems.
According to what CISA has said, “Royal actors have issued ransom demands ranging from around $1 million to $11 million in Bitcoin.”
Meanwhile, the Agency made it clear that in the situations it investigated, The actors did not provide ransom or payment instructions as part of their ransom message.
“Royal ransomware makes advantage of a one-of-a-kind technique to partial encryption that enables the threat actor to choose a certain portion of the data contained inside a file to be encrypted. This strategy gives the actor the ability to reduce the proportion of data that is encrypted for files that are bigger, which makes it easier for them to avoid discovery. In addition to encrypting material, Some actors engage in double extortion techniques in which they threaten to publicly expose encrypted data in the event that the victim does not pay the ransom.
At the time that the article was written, CISA said that actors affiliated with the Royal Family had targeted a number of important infrastructure sectors, including the manufacturing, communications, education, and healthcare industries.
CISA, like the other organizations that have issued #StopRansomware warnings, has included a set of suggestions that aim to limit the risk of ransomware events as well as their effect.
Among them include ensuring that all of the systems are kept up to date, mandating that all of the accounts with password logins adhere to the rules set out by the National Institute of Standards and Technology (NIST), and executing network segmentation wherever it is feasible.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.
