Royal ransomware spreads to Linux and VMware ESXi

A
new
Linux
version
of
Royal
ransomware
is
targeting
VMware
ESXi
virtual
machines.
Learn
more
about
this
security
threat
and
how
to
protect
from
it.

Royal
ransomware
is
malware
that
first
appeared
around
September
2022.
The
people
behind
this
ransomware
are
probably
a

subgroup
of
the
infamous
Conti
threat
actor.
This
subgroup,
which
is
called

Conti
Team
1,
released
the
Zion
ransomware
before
rebranding
it
as
Royal
ransomware.

Royal
spread
so
fast
because
it
became
the
ransomware
making
the

biggest
number
of
victims
in
November
2022
(Figure
A),
taking
the
lead
in
front
of
the

LockBit
ransomware.

Figure
A

Jump
to:

Royal
ransomware’s
delivery
techniques

The

Royal
ransomware
is
spread
via
multiple
ways
with
the
most
common
technique
being
phishing,
according
to
Cyble
Research
&
Intelligence
Labs.

The

malware
was
reported
in
November
2022
by
insurance
company
At-Bay
as
being
likely
the
first
ransomware
to
successfully
exploit
a
Citrix
vulnerability,

CVE-2022-27510,
and
gain
access
to
devices
with
Citrix
ADC
or
Citrix
Gateway
to
operate
ransomware
attacks.
The
threat
actor
used
the
Citrix
vulnerability
before
any
public
exploit,
showing
that
the
ransomware
group
is
amongst
the
most
sophisticated
ransomware
threat
actors.

Royal
ransomware
also
might
be

spread
by
malware
downloaders,
such
as
QBot
or
BATLOADER.

Contact
forms
from
companies
were
also
used
to
distribute
the
ransomware.
The
threat
actor
first
initiates
a
conversation
on
the
target’s
contact
form,
and
once
a
reply
is
provided
by
email,
an
email
containing
a
link
to
BATLOADER
is
sent
to
the
target
in
order
to
operate
Royal
ransomware
in
the
end.

Royal
ransomware
has
also
been

distributed
via
Google
Ads
or
via
the
installation
of
fake
software
pretending
to
be
legitimate
such
as
Microsoft
Teams
or
Zoom,
hosted
on
fake
websites
looking
legitimate.

Microsoft
reported
about
a
fake
TeamViewer
website
that
delivered
a
BATLOADER
executable
that
deployed
Royal
ransomware
(Figure
B).

Figure
B

Uncommon
file
formats
such
as
Virtual
Hard
Disk
impersonating
legitimate
software
have
also
been
used
as
first
stage
downloaders
for
Royal
ransomware.

Royal
ransomware’s
targets

The
most
impacted
industries
targeted
by
Royal
ransomware
are
manufacturing,
professional
services,
and
food
and
beverages
(Figure
C).

Figure
C

As
for
the
location
of
those
industries,
Royal
ransomware
mostly
targets
the
U.S.,
followed
by
Canada
and
Germany
(Figure
D).

Figure
D

The
financial
range
for
the
ransoms
requested
by
the
group
varies
depending
on
the
target
from
$250,000
USD
to
over
$2
million
USD.

A
new
Linux
threat
targeting
VMware
ESXi

The
new
Royal
ransomware
sample
reported
by
Cyble
is
a
64-bit
Linux
executable
compiled
using
GNU
Compiler
Collection.
The
malware
first
performs
an
encryption
test
that
terminates
the
malware
if
it
fails;
it
consists
of
simply
encrypting
the
word
“test”
and
checking
the
result.

SEE:

Massive
ransomware
operation
targets
VMware
ESXi
(TechRepublic)

The
malicious
code
then
collects
information
about
running
VMware
ESXi
virtual
machines
via
the
esxcli
command-line
tool
and
saves
the
output
in
a
file
before
terminating
all
of
the
virtual
machines
by
using
once
again
the
esxcli
tool.

Multi-threading
is
then
deployed
by
the
ransomware
to
encrypt
files,
excluding
a
few
files
such
as
its
own
files:
readme
and
royal_log_*
files
and
files
with
.royal_u
and
.royal_w
file
extensions.
It
also
excludes
.sf,
.v00
and
.b00
extensions.
A
combination
of
RSA
and
AES
encryption
algorithms
is
used
for
the
encryption.

As
the
malware
encrypts
data,
it
creates
the
ransom
notes
in
a
parallel
process
(Figure
E).

Figure
E

How
to
protect
from
this
Royal
ransomware
threat

Since
the
threat
actor
uses
a
variety
of
techniques
to
breach
companies
and
deploy
the
Royal
ransomware,
several
vectors
of
infection
need
to
be
secured.
Further,
the
threat
actor
has
already
proved
it
was
able
to
trigger
non-public
exploits
on
software,
so
all
operating
systems
and
software
need
to
be
always
up
to
date
and
patched.

Emails
are
the
most
commonly
used
way
for
breaching
companies,
and
this
is
true
for
the
Royal
ransomware
gang.
Therefore,
security
solutions
need
to
be
deployed
on
the
web
servers,
and
admins
should
check
all
attached
files
and
links
contained
inside
emails
for
any
malicious
content.
The
check
should
not
only
be
an
automated
static
analysis
but
also
a
dynamic
one
via
sandboxes.

Browsers’
content
should
be
analyzed,
and
browsing
to
unknown
or
low-reputation
websites
should
be
blocked,
as
the
Royal
ransomware
gang
sometimes
uses
new
fake
websites
to
spread
their
malware.

Data
backup
processes
should
be
established,
with
backups
being
regularly
done
but
kept
offline.

Finally,
employees
should
be
made
aware
of
this
ransomware
threat,
particularly
those
who
manipulate
emails
from
unknown
sources,
such
as
press
relations
or
human
resources.

Read
next:

Security
Awareness
and
Training
Policy
(TechRepublic
Premium)

Disclosure:
I
work
for
Trend
Micro,
but
the
views
expressed
in
this
article
are
mine.