{"id":23345,"date":"2022-12-14T11:53:05","date_gmt":"2022-12-14T11:53:05","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/14\/royal-ransomware-group-attacks-surge-with-healthcare-a-prime-target\/"},"modified":"2022-12-14T11:53:05","modified_gmt":"2022-12-14T11:53:05","slug":"royal-ransomware-group-attacks-surge-with-healthcare-a-prime-target","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/14\/royal-ransomware-group-attacks-surge-with-healthcare-a-prime-target\/","title":{"rendered":"Royal ransomware group attacks surge with healthcare a prime target"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Cybersecurity platform provider\u00a0Cybereason Inc.<\/a>\u00a0today released a new report on the activities of the Royal ransomware group a week after the group\u00a0was reported<\/a> to be targeting the healthcare industry in the U.S.<\/p>\n

After emerging in early 2022, Royal gained momentum through the middle of the year, deploying various tactics, techniques and procedures to attack multiple global organizations. The group\u2019s members are suspected of being former members of other ransomware groups based on similarities between Royal and other ransomware operators.<\/p>\n

The group uses a unique approach to evade anti-ransomware defense, expanding on the concept of partial encryption. Royal ransomware attacks have involved encrypting a pre-determined portion of file content with flexible percentage encryption, making detection more challenging for anti-ransomware solutions.<\/p>\n

Royal ransomware employs multiple threads to accelerate the encryption process and notably, operates by itself. Unlike other ransomware operators, Royal does not offer\u00a0ransomware-as-a-service or target a specific sector or country.<\/p>\n

Cybereason researchers assess the threat level from Royal to be high, given the rapid increase in attacks coming from this group over the past 60 to 90 days. Emphasizing the risk, Royal was reported to be the most prolific form of ransomware in November, surpassing the better-known and infamous LockBit<\/a> ransomware gang.<\/p>\n

Royal stands out in using different methods of deployment. One approach is through phishing campaigns with the use of threat loaders such as BTLOADER and Qbot that then download a Cobalt Strike<\/a> payload for further malicious operations.<\/p>\n

Since September, Royal has gained momentum and has added dozens of victims to its website. Although most victims are in the U.S., victims can be found globally, including the Silverstone racing circuit in the U.K.<\/p>\n

Royal may have a connection to the Conti ransomware group, although that\u2019s not confirmed. There are similarities between the two, however, including ransom notes and the use of callback phishing attacks.<\/p>\n

The researchers recommended that Cybereason users enable anti-ransomware protection, enable application control to block the execution of malicious files, enable variant payload prevention and hunt proactively for any machines that could be potentially infected with Royal ransomware.<\/p>\n

Photo: TheRichic\/Wikimedia Commons<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n