# MA-915.032023: MyCERT Advisory - Royal Ransomware

**Date:** 22 Mar 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-915.032023  
**Advisory ID:** MA-915.032023

---

**1.0 Introduction**
Since approximately September 2022, cyber criminals have organizations with a Royal ransomware variant, which uses its own custom-made file encryption program. It evolved from earlier iterations that used “Zeon” as a loader.
**2.0 Impact**
After gaining access to victims’ networks, Royal actors disable antivirus software and exfiltrate large amounts of data before ultimately deploying the ransomware and encrypting the systems. Royal actors have made ransom demands ranging from approximately $1 million to $11 million USD in Bitcoin. In observed incidents, Royal actors do not include ransom amounts and payment instructions as part of the initial ransom note. Instead, the note, which appears after encryption, requires victims to interact directly with the threat actor via a .onion URL (reachable through the [Tor browser](https://cisa.gov/uscert/ncas/alerts/aa20-183a)). Royal actors have targeted numerous [critical infrastructure sectors](https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors) including, but not limited to, Manufacturing, Communications, Healthcare and Public Healthcare (HPH), and Education.
**3.0 Techniques, Tactics and Procedures (TTPs)Initial Access**
Royal actors gain initial access to victim networks in a number of ways, cybercriminals including:
- **Phishing.** According to third-party reporting, Royal actors most commonly (in 66.7% of incidents) gain initial access to victim networks via successful phishing emails [[T1566](https://attack.mitre.org/versions/v12/techniques/T1566/)].
- According to open-source reporting, victims have unknowingly installed malware that delivers Royal ransomware after receiving phishing emails containing malicious PDF documents [[T1566.001](https://attack.mitre.org/versions/v12/techniques/T1566/001/)], and malvertising [[T1566.002](https://attack.mitre.org/versions/v12/techniques/T1566/002/)].[[2](https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/)]
- **Remote Desktop Protocol (RDP). RDP compromise is the second most common vector Royal actors use (in 13.3% of incidents) for initial access**
- **Public-facing applications.** FBI has also observed Royal actors gain initial access through exploiting public-facing applications [[T1190](https://attack.mitre.org/versions/v12/techniques/T1190/)].
- **Brokers.** Reports from trusted third-party sources indicate that Royal actors may leverage brokers to gain initial access and source traffic by harvesting virtual private network (VPN) credentials from stealer logs.
**Command and Control**
Once Royal actors gain access to the network, they communicate with command and control (C2) infrastructure and download multiple tools [[T1105](https://attack.mitre.org/versions/v12/techniques/T1105/)]. Legitimate Windows software is repurposed by Royal operators to strengthen their foothold in the victim’s network. Ransomware operators often use open-source projects to aid their intrusion activities; Royal operators have recently been observed using Chisel, a tunneling tool transported over HTTP and secured via SSH [[T1572](https://attack.mitre.org/versions/v12/techniques/T1572/)], to communicate with their C2 infrastructure. FBI has observed multiple Qakbot C2s used in Royal ransomware attacks, but has not yet determined if Royal ransomware exclusively uses Qakbot C2s.
**Lateral Movement and Persistence**
Royal actors often use RDP to move laterally across the network [[T1021.001](https://attack.mitre.org/versions/v12/techniques/T1021/001/)]. Microsoft Sysinternals tool PsExec has also been used to aid lateral movement. FBI has observed Royal actors using remote monitoring and management (RMM) software, such as AnyDesk, LogMeIn, and Atera, for persistence in the victim’s network [[T1133](https://attack.mitre.org/versions/v12/techniques/T1133/)]. In some instances, the actors moved laterally to the domain controller. In one confirmed case, the actors used a legitimate admin account to log on to the domain controller [T1078] remotely, typically. Once on the domain controller, the threat actor deactivated antivirus protocols [[T1562.001](https://attack.mitre.org/versions/v12/techniques/T1562/001/)] by modifying Group Policy Objects [[T1484.001](https://attack.mitre.org/versions/v12/techniques/T1484/001/)].
**Exfiltration**
Royal actors exfiltrate data from victim networks by repurposing legitimate cyber pen-testing tools, such as Cobalt Strike, and malware tools and derivatives, such as Ursnif/Gozi, for data aggregation and exfiltration. According to third-party reporting, Royal actors’ first hop in exfiltration and other operations is usually a U.S. IP address.
*Note: In reference to Cobalt Strike and other tools mentioned above, a tool repository used by Royal was identified at IP: 94.232.41[.]105 in December 2022.*Encryption**
Before starting the encryption process, Royal actors:
- Use Windows Restart Manager to determine whether targeted files are currently in use or blocked by other applications [[T1486](https://attack.mitre.org/versions/v12/techniques/T1486/)].[[1](https://www.cybereason.com/blog/royal-ransomware-analysis)]
- Use Windows Volume Shadow Copy service (vssadmin.exe) to delete shadow copies to prevent system recovery.[[1](https://www.cybereason.com/blog/royal-ransomware-analysis)]
FBI has found numerous batch (.bat) files on impacted systems which are typically transferred as an encrypted 7zip file. Batch files create a new admin user [[T1078.002](https://attack.mitre.org/versions/v12/techniques/T1078/002/)], force a group policy update, set pertinent registry keys to auto-extract [[T1119](https://attack.mitre.org/versions/v12/techniques/T1119/)] and execute the ransomware, monitor the encryption process, and delete files upon completion—including Application, System, and Security event logs [[T1070.001](https://attack.mitre.org/versions/v12/techniques/T1070/001/)].
Malicious files have been found in victim networks in the following directories:
- C:\Temp\
- C:\Users\<user>\AppData\Roaming\
- C:\Users\<users>\
- C:\ProgramData\
**4.0 Indicators of CompromiseIndicators of Compromise (IOC)**
See Tables 1 and 2 for Royal ransomware IOCs that the FBI obtained during threat response activities as of January 2023. **Note:** Some of the observed IP addresses are several months old. FBI and CISA recommend vetting or investigating these IP addresses prior to taking forward-looking action, such as blocking.
Table 1: Royal Ransomware Associated Files, Hashes, and IP addresses as of January 2023
| **IOC** | **Description** | --- | --- | .royal | Encrypted file extension | README.TXT | Ransom note | **Malicious IP** | **Last Activity** | 102.157.44[.]105 | November 2022 | 105.158.118[.]241 | November 2022 | 105.69.155[.]85 | November 2022 | 113.169.187[.]159 | November 2022 | 134.35.9[.]209 | November 2022 | 139.195.43[.]166 | November 2022 | 139.60.161[.]213 | November 2022 | 148.213.109[.]165 | November 2022 | 163.182.177[.]80 | November 2022 | 181.141.3[.]126 | November 2022 | 181.164.194[.]228 | November 2022 | 185.143.223[.]69 | November 2022 | 186.64.67[.]6 | November 2022 | 186.86.212[.]138 | November 2022 | 190.193.180[.]228 | November 2022 | 196.70.77[.]11 | November 2022 | 197.11.134[.]255 | November 2022 | 197.158.89[.]85 | November 2022 | 197.204.247[.]7 | November 2022 | 197.207.181[.]147 | November 2022 | 197.207.218[.]27 | November 2022 | 197.94.67[.]207 | November 2022 | 23.111.114[.]52 | November 2022 | 41.100.55[.]97 | November 2022 | 41.107.77[.]67 | November 2022 | 41.109.11[.]80 | November 2022 | 41.251.121[.]35 | November 2022 | 41.97.65[.]51 | November 2022 | 42.189.12[.]36 | November 2022 | 45.227.251[.]167 | November 2022 | 5.44.42[.]20 | November 2022 | 61.166.221[.]46 | November 2022 | 68.83.169[.]91 | November 2022 | 81.184.181[.]215 | November 2022 | 82.12.196[.]197 | November 2022 | 98.143.70[.]147 | November 2022 | 140.82.48[.]158 | December 2022 | 147.135.36[.]162 | December 2022 | 147.135.11[.]223 | December 2022 | 152.89.247[.]50 | December 2022 | 172.64.80[.]1 | December 2022 | 179.43.167[.]10 | December 2022 | 185.7.214[.]218 | December 2022 | 193.149.176[.]157 | December 2022 | 193.235.146[.]104 | December 2022 | 209.141.36[.]116 | December 2022 | 45.61.136[.]47 | December 2022 | 45.8.158[.]104 | December 2022 | 5.181.234[.]58 | December 2022 | 5.188.86[.]195 | December 2022 | 77.73.133[.]84 | December 2022 | 89.108.65[.]136 | December 2022 | 94.232.41[.]105 | December 2022 | 47.87.229[.]39 | January 2023 | **Malicious Domain** | **Last Observed** | ciborkumari[.]xyz | October 2022 | sombrat[.]com | October 2022 | gororama[.]com | November 2022 | softeruplive[.]com | November 2022 | altocloudzone[.]live | December 2022 | ciborkumari[.]xyz | December 2022 | myappearinc[.]com | December 2022 | parkerpublic[.]com | December 2022 | pastebin.mozilla[.]org/Z54Vudf9/raw | December 2022 | tumbleproperty[.]com | December 2022 | myappearinc[.]com/acquire/draft/c7lh0s5jv | January 2023 |
Table 2: Tools used by Royal operators
| **Tool** | **SHA256** | --- | --- | AV tamper | 8A983042278BC5897DBCDD54D1D7E3143F8B7EAD553B5A4713E30DEFFDA16375 | TCP/UDP Tunnel over HTTP (Chisel) | 8a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451 | Ursnif/Gozi | be030e685536eb38ba1fec1c90e90a4165f6641c8dc39291db1d23f4ee9fa0b1 | Exfil | B8C4AEC31C134ADBDBE8AAD65D2BCB21CFE62D299696A23ADD9AA1DE082C6E20 | Remote Access (AnyDesk) | 4a9dde3979c2343c024c6eeeddff7639be301826dd637c006074e04a1e4e9fe7 | PowerShell Toolkit Downloader | 4cd00234b18e04dcd745cc81bb928c8451f6601affb5fa45f20bb11bfb5383ce | PsExec (Microsoft Sysinternals) | 08c6e20b1785d4ec4e3f9956931d992377963580b4b2c6579fd9930e08882b1c | Keep Host Unlocked (Don’t Sleep) | f8cff7082a936912baf2124d42ed82403c75c87cb160553a7df862f8d81809ee | Ransomware Executable | d47d4b52e75e8cf3b11ea171163a66c06d1792227c1cf7ca49d7df60804a1681 | Windows Command Line (NirCmd) | 216047C048BF1DCBF031CF24BD5E0F263994A5DF60B23089E393033D17257CB5 | System Management (NSudo) | 19896A23D7B054625C2F6B1EE1551A0DA68AD25CDDBB24510A3B74578418E618 | **Batch Scripts** |
| **Filename** | **Hash Value** | 2.bat | 585b05b290d241a249af93b1896a9474128da969 | 3.bat | 41a79f83f8b00ac7a9dd06e1e225d64d95d29b1d | 4.bat | a84ed0f3c46b01d66510ccc9b1fc1e07af005c60 | 8.bat | c96154690f60a8e1f2271242e458029014ffe30a | kl.bat | 65dc04f3f75deb3b287cca3138d9d0ec36b8bea0 | gp.bat | 82f1f72f4b1bfd7cc8afbe6d170686b1066049bc7e5863b51aa15ccc5c841f58 | r.bat | 74d81ef0be02899a177d7ff6374d699b634c70275b3292dbc67e577b5f6a3f3c | runanddelete.bat | 342B398647073159DFA8A7D36510171F731B760089A546E96FBB8A292791EFEE |
**5.0 Recommendations**
MyCERT recommends network defenders apply the following mitigations to limit potential adversarial use of the common system and network discovery techniques and to reduce the risk of compromise by Royal ransomware. These mitigations follow [CISA’s Cybersecurity Performance Goals (CPGs)](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf), which provide a minimum set of practices and protections that are informed by the most common and impactful threats, tactics, techniques, and procedures and which yield goals that all organizations across critical infrastructure sectors should implement:
- **Implement a recovery plan** to maintain and retain multiple copies of sensitive or proprietary data and servers [[CPG 7.3](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)] in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).
- **Require all accounts** with password logins (e.g., service accounts, admin accounts, and domain admin accounts) **to comply** with [National Institute for Standards and Technology (NIST) standards](https://pages.nist.gov/800-63-3/) for developing and managing password policies [[CPG 3.4](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)].
- Use longer passwords consisting of at least 8 characters and no more than 64 characters in length [[CPG 1.4](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)].
- Store passwords in a hashed format using industry-recognized password managers.
- Add password user “salts” to shared login credentials.
- Avoid reusing passwords.
- Implement multiple failed login attempt account lockouts [[CPG 1.1](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)].
- Disable password hints.
- Refrain from requiring password changes more frequently than once per year. **Note:** NIST guidance suggests favouring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber criminals can easily decipher.
- Require administrator credentials to install the real-timesoftware.
- **Require multifactor authentication** [[CPG 1.3](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)] for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.
- **Keep all operating systems, software, and firmware up to date.** Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats.
- **Segment networks** [[CPG 8.1](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)]. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and restricting adversary lateral movement.
- **Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.** To aid in detecting ransomware, implement a tool that logs and reports all network traffic [[CPG 5.1](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)], including lateral movement activity on a network. Endpoint detection and response (EDR) tools are useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.
- **Install, regularly update, and enable real time detection for antivirus software** on all hosts.
- **Review domain controllers, servers, workstations, and active directories** for new and/or unrecognized accounts.
- **Audit user accounts** with administrative privileges and configures access controls according to the principle of least privilege [[CPG 1.5](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)].
- **Disable unused ports**.
- **Consider adding an email banner to emails** [[CPG 8.3](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)] received from outside your organization.
- **Implement time-based access for accounts set at the admin level and higher.** For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model). This is a process where a network-wide policy is set to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need support completing a certain task.
- **Disable command-line and scripting activities and permissions**. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors cannot run these tools, they will have difficulty escalating privileges and/or moving laterally.
- **Maintain offline backups of data** and regularly maintain backup and restoration [[CPG 7.3](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)]. By instituting this practice, the organization ensures they will not be severely interrupted and/or only have irretrievable data.
- **Ensure all backup data is encrypted, immutable** (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [[CPG 3.3](https://www.cisa.gov/sites/default/files/publications/2022_00092_CISA_CPG_Report_508c.pdf)].
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.stopransomware.gov/>
- <https://www.cybereason.com/blog/royal-ransomware-analysis>
- <https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/>
- <https://www.cyber.gov.au/acsc/view-all-content/advisories/2023-01-acsc-ransomware-profile-royal>