All Threat Groups
ID: royal
Royal Syndicate Dossier
First Intercepted
2022-11-04
Latest Disclosure
2023-07-19
Victim Velocity
1.0 / claim
Threat Profile & Operational Narrative
Active from September 2022 to mid-2023 before rebranding into BlackSuit, Royal was an elite private cyber syndicate launched by veteran operators from the Conti ransomware group (initially tracked as DEV-0569 and Team9). The 64-bit C++ encryptor utilized partial encryption routines via OpenSSL (AES-256 or ChaCha20) across Windows and VMware ESXi systems to significantly evade endpoint detection and increase encryption velocity. The group pioneered massive callback phishing campaigns (vishing), leveraged malvertising/Google Ads deploying malicious loaders, and weaponized compromised remote access credentials against large enterprise organizations globally.
Tactics, Techniques & Procedures (MITRE ATT&CK)
T1566.001: Spearphishing Attachment T1566.002: Spearphishing Link T1190: Exploit Public-Facing Application T1078: Valid Accounts T1059.001: PowerShell T1059.003: Windows Command Shell T1047: Windows Management Instrumentation T1021.001: Remote Desktop Protocol T1021.002: SMB/Windows Admin Shares T1486: Data Encrypted for Impact T1490: Inhibit System Recovery T1567.002: Exfiltration to Cloud Storage
Known Dark Web Infrastructure & Mirrors
royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion
OFFLINE
royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion
OFFLINE
Disclosed Victims & Incident Archive (357)
| Disclosed | Victim Organization | Sector | Country |
|---|---|---|---|
| 2023-07-19 | http://www.braintreema.gov | General | -- |
| 2023-07-19 | Braintree Public Schools | General | -- |
| 2023-06-11 | http://www.tachi-s.com | General | -- |
| 2023-06-11 | Tachi-S Engineering USA | General | -- |
| 2023-06-09 | http://www.penncrest.org | General | -- |
| 2023-06-09 | PENNCREST School District | General | -- |
| 2023-05-26 | http://www.colrich.com | General | -- |
| 2023-05-26 | http://www.haworthtompkins.com | General | -- |
| 2023-05-26 | http://www.co-pack.co.uk | General | -- |
| 2023-05-26 | http://www.sovitrat.fr | General | -- |
| 2023-05-26 | http://www.bmprecision.com | General | -- |
| 2023-05-26 | http://www.directviz.com | General | -- |
| 2023-05-26 | http://www.thebestconnection.co.uk | General | -- |
| 2023-05-26 | http://www.mitutoyo.ch | General | -- |
| 2023-05-26 | http://www.afgholdings.com | General | -- |
| 2023-05-26 | http://www.volt.com | General | -- |
| 2023-05-26 | Groupe Sovitrat Interim and Recrutement | General | -- |
| 2023-05-26 | BM Precision | General | -- |
| 2023-05-26 | DirectViz Solutions | General | -- |
| 2023-05-26 | The Best Connection | General | -- |
| 2023-05-26 | Mitutoyo | General | -- |
| 2023-05-26 | AFG Holdings | General | -- |
| 2023-05-26 | Volt | General | -- |
| 2023-05-26 | Colrich | General | -- |
| 2023-05-26 | Haworth Tompkins | General | -- |
| 2023-05-26 | Grange Packing Solutions | General | -- |
| 2023-05-23 | http://www.co.coos.or.us | General | -- |
| 2023-05-23 | http://www.dotcomdist.com | General | -- |
| 2023-05-23 | Coos Bay | General | -- |
| 2023-05-23 | Dotcom Distribution | General | -- |
| 2023-05-22 | http://westside-health.org | General | -- |
| 2023-05-22 | http://www.utahyamas.com | General | -- |
| 2023-05-22 | http://morrishospital.org | General | -- |
| 2023-05-22 | http://www.trinityexploration.com | General | -- |
| 2023-05-22 | Westside | General | -- |
| 2023-05-22 | TA Supply | General | -- |
| 2023-05-22 | Trinity Exploration and Production | General | -- |
| 2023-05-22 | Agostini Insurance Brokers | General | -- |
| 2023-05-22 | Atlas Commodities | General | -- |
| 2023-05-22 | Morris Hospital | General | -- |
| 2023-05-22 | Utah-Yamas Controls | General | -- |
| 2023-05-19 | http://www.dallascityhall.com | General | -- |
| 2023-05-19 | City of Dallas | General | -- |
| 2023-05-18 | http://www.nashua.edu | General | -- |
| 2023-05-18 | NASHUA SCHOOL DISTRICT | General | -- |
| 2023-05-15 | http://www.parkerdrilling.comwww.parkerwellbore.com | General | -- |
| 2023-05-15 | Parker Drilling | General | -- |
| 2023-05-05 | http://meadetractor.com | General | -- |
| 2023-05-04 | http://www.midwesttruck.com | General | -- |
| 2023-05-03 | http://www.southernwv.edu | General | -- |
| 2023-05-03 | http://zbw.eu | General | -- |
| 2023-05-03 | Southern West Virginia Community and Technical College | General | -- |
| 2023-05-03 | ZBW News | General | -- |
| 2023-05-02 | http://www.gfcmsu.edu | General | -- |
| 2023-05-02 | http://www.montana.edu | General | -- |
| 2023-05-01 | http://www.edisonlearning.com | General | -- |
| 2023-05-01 | Midwest Truck | General | -- |
| 2023-04-29 | Great Falls College of Technology | General | -- |
| 2023-04-29 | Montana State University | General | -- |
| 2023-04-26 | EdisonLearning | General | -- |
| 2023-04-25 | http://www.encompassgroup.com | General | -- |
| 2023-04-24 | http://www.ldisd.net | General | -- |
| 2023-04-24 | http://www.mwcomponents.com | General | -- |
| 2023-04-24 | http://clarkehosp.org | General | -- |
| 2023-04-21 | http://www.gks-hydraulik.com | General | -- |
| 2023-04-21 | Encompass Group | General | -- |
| 2023-04-21 | GKS Hydraulik | General | -- |
| 2023-04-20 | Clarke County Hospital | General | -- |
| 2023-04-18 | http://mainstream-engr.com | General | -- |
| 2023-04-18 | http://ballwin.mo.us | General | -- |
| 2023-04-18 | Lake Dallas Independent School District | General | -- |
| 2023-04-18 | MW Components | General | -- |
| 2023-04-17 | http://www.swansongroup.biz | General | -- |
| 2023-04-17 | http://www.mooncapital.com | General | -- |
| 2023-04-16 | http://www.talonoutdoor.com | General | -- |
| 2023-04-16 | http://dataram.com | General | -- |
| 2023-04-14 | City of Ballwin | General | -- |
| 2023-04-13 | Swanson Group | General | -- |
| 2023-04-13 | Moon Capital | General | -- |
| 2023-04-12 | http://einhaus-gruppe.de | General | -- |
| 2023-04-12 | Talon Outdoor | General | -- |
| 2023-04-12 | Dataram | General | -- |
| 2023-04-10 | http://www.stanleyelectricus.com | General | -- |
| 2023-04-10 | http://www.naturespath.com | General | -- |
| 2023-04-10 | http://www.tomduffy.com | General | -- |
| 2023-04-10 | http://www.alvaria.com | General | -- |
| 2023-04-10 | http://www.bigassfans.com | General | -- |
| 2023-04-10 | Stanley Electric U.S. | General | -- |
| 2023-04-10 | Nature Path Foods | General | -- |
| 2023-04-10 | Alvaria | General | -- |
| 2023-04-10 | Big Ass Fans | General | -- |
| 2023-04-10 | Tom Duffy Company | General | -- |
| 2023-04-07 | http://www.beghelliusa.com | General | -- |
| 2023-04-07 | http://www.kretek.com | General | -- |
| 2023-04-05 | Kretek International | General | -- |
| 2023-04-03 | http://corizonhealth.com | General | -- |
| 2023-04-03 | http://sunstar.com | General | -- |
| 2023-04-03 | http://5design.net | General | -- |
| 2023-04-03 | http://www.teijincarbon.com | General | -- |
| 2023-04-03 | http://stevesilver.com | General | -- |
Showing 100 most recent disclosures of 357 total records. Use the Live Feed or API for complete records.