A ransomware operation named Royal is quickly ramping up, targeting corporations with ransom demands ranging from $250,000 to over $2 million.
Royal is an operation that launched in January 2022 and consists of a group of vetted and experienced ransomware actors from previous operations.
Unlike most active ransomware operations, Royal does not operate as a Ransomware-as-a-Service but is instead a private group without affiliates.
Vitali Kremez, CEO of
AdvIntel, told BleepingComputer that they utilized other ransomware operation's encryptors when first starting, such as BlackCat.
Soon after, the cybercrime enterprise began
using its own encryptors, the first being Zeon [
Sample], which generated ransom notes very similar to Conti's.
However, since the middle of September 2022, the ransomware gang has rebranded again to 'Royal' and is using that name in ransom notes generated by a new encryptor.
