Royal Ransomware

▤ Summary

The infection chain that ultimately ends with the deployment of the Royal Ransomware threat, begins with targeted phishing attacks. They begin by sending lure emails about bogus subscription renewals for a legitimate food delivery service or software product. The phone operators work for the cybercriminals and will use various social-engineering tactics to convince the victim to provide them with remote access to the computer. When the Royal Ransomware threat is deployed and executed on the victims devices, it will encrypt a significant portion of the data stored there. The ransom note states that victims must establish contact with the cybercriminals by visiting their dedicated website hosted on the TOR network.

▦ Linked Companies

EnigmaSoft

$1M to $5M