Royal Ransomware: Inside a targeted attack

TL;DR

Royal ransomware is a targeted and sophisticated threat that not only encrypts data but also copies it to a secure server, making it potentially damaging for victims if released on the dark net.

Transcript

hello and welcome to the PC security channel in this video we're going to take a look at Royal ransomware fairy fitting considering we've just had the coronation of a new monarch as you can see already this file is quite interesting so like most ransomware it is not a simple exe file that gets executed instead we have two components one is the exe ... Read More

Key Insights

• 🤴 Royal ransomware is an example of a targeted and sophisticated threat that aims to encrypt and potentially blackmail victims by copying their encrypted data to a secure server.
• 🎨 The ransomware is designed to avoid accidental deployment on random systems and is deployable only by attackers who have gained access to the victim's network.
• 📁 The ransomware's batch file plays a crucial role in initiating the encryption process by executing the main executable file.
• 😶‍🌫️ Protecting endpoint devices is essential in preventing ransomware attacks, as attackers often bypass email server and cloud-level scans by encrypting their payloads.
• ✋ Royal ransomware has had a significant impact on the US and UK, with a high number of samples being detected in Turkey as well.
• 🤴 The attackers behind Royal ransomware employ proactive and targeted strategies, spying on specific companies and individuals to gain access to their systems.
• 👊 Ransomware attacks serve not only to encrypt data but also to disrupt business activities and potentially release sensitive information on the dark net.

Questions & Answers

Q: How does Royal ransomware differ from other ransomware attacks?

Unlike many other ransomware attacks, Royal ransomware is designed to specifically target and encrypt the data of selected victims. It also copies the encrypted files to a secure server, potentially using them for blackmail purposes.

Q: How is the encryption process carried out by Royal ransomware?

The encryption process is executed by running the batch file associated with the ransomware. The batch file contains commands to execute the ransomware's main executable file (exe), specifying the encryption path and the victim's ID for tracking purposes.

Q: Can Royal ransomware be detected by antivirus engines?

When uploaded to VirusTotal, Royal ransomware shows detections by approximately 40 to 50 antivirus engines. However, running the ransomware's exe file on a system does not immediately show any visible effects, as it is designed to avoid detection.

Q: How can victims of Royal ransomware recover their encrypted data?

The readme file left by Royal ransomware instructs victims to contact the attackers to pay a ransom and have their data decrypted. However, it is generally advised not to pay the ransom as there is no guarantee that the attackers will honor their promise.

Summary & Key Takeaways

• Royal ransomware consists of two components: an executable file (exe) and a batch file that carries out the encryption process.

• The ransomware is designed to target specific victims and is not meant to be accidentally deployed on random systems.

• In addition to encrypting data, Royal ransomware copies the encrypted files to a secure server, potentially using them for future blackmail.