Threat Actor Characterization
Royal
ID: 3e5e6915cdeeeaf6aba6781fc675f77467078| Royal Ransomware | Royal Ransomware Group | Ro************* | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Royal/BlackSuit — human-operated ransomware with callback phishing, credential abuse, rapid lateral movement, data theft, and encryption.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566 | Phishing | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Royal is a human-operated ransomware group first observed in 2022 and later associated with the BlackSuit rebrand. Campaigns commonly start with callback phishing leading to hands-on intrusions, credential abuse, rapid lateral movement (RDP/Cobalt Strike/PSExec), data theft, and encryption. Pressure is applied through leak-site shaming and negotiations. Confidence: high.
Closed, profit-motivated crew believed to include former Conti-line operators. Uses leak portals/negotiation sites and a consistent victim-shaming workflow.
Objective: monetize through double-extortion (exfiltration + encryption). Heavy reliance on social engineering for initial access (callback phishing).