Threat Assessment: Royal Ransomware
Summary: Royal ransomware, first observed in September 2022 and suspected to be built from former Conti members known as Team One, has claimed 157 organizations on its leak site and made ransom demands up to $25 million in BTC. Unit 42 responders handled 15 Royal cases in nine months, with 64% of impacted organizations in the United States and the group hitting manufacturing, healthcare, education, and local government, including the city of Dallas.
What you should know: This is a private group of operators with lineage back to Ryuk and Conti, not a rented affiliate program, and it has already disrupted healthcare, education, and local government while demanding up to $25 million. A crew that harasses victims by mass-printing ransom notes and running a public Twitter account is not optimizing for quiet negotiations.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026