---
title: Royal Ransomware
description: DEV-0569 recently began delivering Royal ransomware. Microsoft reported on this campaign.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Royal Ransomware](https://blog.polyswarm.io/royal-ransomware)

 Written by [PolySwarm Tech Team](https://blog.polyswarm.io/author/polyswarm-tech-team) | Dec 1, 2022 6:22:05 PM

**Executive Summary**

Microsoft recently [reported](https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/) on Royal ransomware, a ransomware family used by the threat actor DEV-0569

**Key Takeaways**

- Royal ransomware is a 64-bit executable written in C++ that targets Windows systems.
- Royal is used by multiple threat actors, including DEV-0569.
- DEV-0569 is a financially motivated threat actor that uses malvertising, phishing, and malicious downloaders to spread malware.

**What is Royal?**

Royal ransomware is a ransomware family used by the threat actor group DEV-0569. Royal was first seen in the wild in early 2022 and is in use by multiple threat actor groups. It is a 64-bit executable written in C++ that targets Windows systems. Royal uses the OpenSSL library to encrypt files to AES standard. It appends the .royal extension to encrypted files. DEV-0569 delivers Royal using human-operated ransomware attacks. The threat actors gain access to compromised networks using BATLOADER to deliver a Cobalt Strike Beacon.

Who is DEV-0569?

At present, the identity and location of DEV-0569 threat actors have not been determined by industry researchers. We know they are a financially motivated threat actor group that likely serves as an initial access broker for other threat actors. DEV-0569 attacks typically begin with malicious ads, forum posts, blog comments, or phishing emails that deliver malicious links. The links lead to malicious files signed by the threat actor using legitimate certificates. DEV-0569 uses malvertising, phishing links, and malicious downloaders masquerading as installers or updates to spread malware. The group has also been observed using VHD files that impersonate legitimate software to facilitate the delivery of first-stage payloads.

Microsoft noted the group has begun using contact forms on a target organization’s websites to deliver phishing links, hosting fake installer files on sites that seem legitimate download sites, and expanding their malvertising technique by using Google Ads to blend in with regular ad traffic. These tactics give DEV-0569 the capability to reach more targets with the intended payloads. Dev-0569 is known to employ defensive evasion techniques and uses Nsudo to disable antivirus. The group typically uses the services of other malicious actors that deliver malware payloads as a service.

**IOCs**

PolySwarm has multiple samples of Royal.

[F484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429](https://polyswarm.network/scan/results/file/F484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429)

[9db958bc5b4a21340ceeeb8c36873aa6bd02a460e688de56ccbba945384b1926](https://polyswarm.network/scan/results/file/9db958bc5b4a21340ceeeb8c36873aa6bd02a460e688de56ccbba945384b1926)

You can use the following CLI command to search for all Royal samples in our portal:

**$ polyswarm link list -f Royal

*Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

[View full post](https://blog.polyswarm.io/royal-ransomware)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "PolySwarm Tech Team"
  },
  "dateModified" : "2022-12-01T18:22:05.520Z",
  "datePublished" : "2022-12-01T18:22:05Z",
  "headline" : "Royal Ransomware",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1513,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/RoyalRansomware.jpg",
    "width" : 2655
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/royal-ransomware",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```