Royal Ransomware Threat Takes Aim at U.S. Healthcare System

Dec 12, 2022Ravie LakshmananHealthcare IT / Ransomware

The U.S. Department of Health and Human Services (HHS) has
cautioned of ongoing Royal ransomware attacks targeting healthcare
entities in the country.

“While most of the known ransomware operators have performed
Ransomware-as-a-Service, Royal appears to be a private group
without any affiliates while maintaining financial motivation as
their goal,” the agency’s Health Sector Cybersecurity Coordination
Center (HC3) said^[1]
[PDF].

“The group does claim to steal data for double-extortion
attacks, where they will also exfiltrate sensitive data.”

Royal ransomware, per Fortinet FortiGuard Labs^[2], is said to be active
since at least the start of 2022. The malware is a 64-bit Windows
executable written in C++ and is launched via the command line,
indicating that it involves a human operator to trigger the
infection after obtaining access to a targeted environment.

Besides deleting volume shadow copies on the system, Royal
utilizes the OpenSSL cryptographic library to encrypt files to the
AES standard and appends them with a “.royal” extension.

Last month, Microsoft disclosed that a group it’s tracking under
the name DEV-0569^[3]
has been observed deploying the ransomware family through a variety
of methods.

This includes malicious links delivered to victims by means of
malicious ads, fake forum pages, blog comments, or through phishing
emails that lead to rogue installer files for legitimate apps like
Microsoft Teams or Zoom.

The files are known to harbor a malware downloader dubbed
BATLOADER, which is then used to deliver a wide variety of payloads
such as Gozi, Vidar, BumbleBee, in addition to abusing genuine
remote management tools like Syncro to deploy Cobalt Strike for
subsequent ransomware deployment.

The ransomware gang, despite its emergence only this year, is
believed to comprise experienced actors from other operations,
indicative of the ever-evolving nature of the threat landscape.

“Originally, the ransomware operation used BlackCat’s encryptor,
but eventually started using Zeon, which generated a ransomware
note that was identified as being similar to Conti’s,” the HHS
said. “This note was later changed to Royal in September 2022.”

The agency further noted that Royal ransomware attacks on
healthcare have primarily focused on organizations in the U.S.,
with payment demands ranging from $250,000 to $2 million.