Royal Ransom (Windows)
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:10:43
Targeted industries: healthcare-and-pharmaceutical government-and-public-sector financial-services
Context
Royal Ransom is a type of ransomware that targets various industries by encrypting data and demanding ransom payments for decryption keys. It employs advanced evasion techniques and is known for targeting critical sectors such as healthcare and public services.
Reports & references
- Microsoft — Dev 0569 Finds New Ways To Deliver Royal Ransomware Various Payloads (report)
- bleepingcomputer.com — Law Enforcement Seizes Blacksuit Ransomware Leak Sites (report)
- redsense.com — Royal Blacksuit How Ransomware Rebrand Reshaped Them (report)
- bleepingcomputer.com — March 2023 Broke Ransomware Attack Records With 459 Incidents (report)
- bridewell.com — Hunting For Ursnif (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Royal Ransom (report)
- Trend Micro — Conti Team One Splinter Group Resurfaces As Royal Ransomware Wit (report)
- trellix.com — A Royal Analysis Of Royal Ransom (report)
- socradar.io — Dark Web Profile Royal Ransomware (report)
- securityscorecard.pathfactory.com — The Royal Ransomware (report)
- cybereason.com — Royal Ransomware Analysis (report)
- avertium.com — Everything You Need To Know About Royal Ransomware (report)
- logpoint.com — Exploring The Exploit Of Royal Ransomware (report)
- yoroi.company — Reconstructing The Last Activities Of Royal Ransomware (report)
- bleepingcomputer.com — New Royal Ransomware Emerges In Multi Million Dollar Attacks (report)
- fortinet.com — Ransomware Roundup Royal Ransomware (report)
- coalitioninc.com — Active Exploitation Firewalls (report)
- cyber.gov.au — 2023 01 Acsc Ransomware Profile Royal (report)
- cyber.gov.au — 2023 01 Acsc Ransomware Profile Royal (report)
- mandiant.widen.net — M Trends 2023 (report)
- Palo Alto Unit 42 — Royal Ransomware (report)
- Trend Micro — Royal Ransomware Expands Attacks By Targeting Linux Esxi Servers (report)
- Cisco Talos — Talos Ir Q2 2023 Quarterly Recap (report)
- noticeofpleadings.com — 1%20 Microsoft%20Cobalt%20Strike%20 %20Complaint(907040021.9) (report)
- intrinsec.com — Tlp Clear 31072025 Shadowsyndicate Infrastructure Illumination En (report)