RoyalCli
- Malware type
- backdoor
- Family
- Malware family
- Profile updated
- 2026-07-07 12:39:38
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
RoyalCli is a backdoor which appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary. RoyalCli and BS2005 both communicate with the attacker's command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Royalcli_Auto (yara-rule)
Reports & references
- github.com — Royal Apt (report)
- research.nccgroup.com — Apt15 Is Alive And Strong An Analysis Of Royalcli And Royaldns (report)
- secureworks.com — Bronze Palace (report)
- nccgroup.trust — Apt15 Is Alive And Strong An Analysis Of Royalcli And Royaldns (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Royalcli (report)