The Royal Ransomware Group has emerged, and Cybereason, the XDR company, today released a new worldwide danger notice alerting public and private sector companies about the group's use of distinctive tactics, strategies, and procedures in attacks to elude detection. Due to the fact that hackers target weak enterprises around the holidays and on the weekends, businesses should be extremely vigilant against ransomware assaults.
Since its initial appearance this year, the Royal Ransomware Group has attacked scores of companies all around the world. The group appears to be run by the Conti Group and other well-known ransomware organizations. Organizations should take precautions to prevent being victims because the threat level from Royal attacks is “HIGH.”
Important report findings
Unusual method of dodging anti-ransomware defenses: Royal ransomware extends the idea of partial encryption by having the capacity to encrypt a specific piece of the file content and basing it on configurable percentage encryption, making detection by anti-ransomware solutions more difficult.
Ransomware that uses multiple threads: Royal ransomware uses several threads to hasten the encryption process.
Global ransomware operation: The Royal ransomware purportedly runs independently and globally. The gang doesn't seem to target a particular industry or nation or utilize ransomware-as-a-service.
High Severity: Given the sharp rise in attacks from this group over the previous 60–90 days, Cybereason rates the threat level from Royal Ransomware as HIGH.
Mitigation Tips
Maintain excellent security hygiene by, for instance, implementing a programme for staff security awareness and making sure operating systems and other software are routinely patched and updated.
Verify that important players can be reached whenever needed: Attacks that happen over holidays and weekends may cause critical reaction activities to be delayed.
Conduct routine drills and exercises on a table: Include important stakeholders from other departments outside security, such as Legal, HR, IT, and senior executives, so that everyone is aware of their duties and responsibilities and can react as quickly as possible.
Implementing unambiguous isolation procedures will block any more network intrusions and stop ransomware from spreading to other systems. The ability to disconnect a host, lock down a hacked account, and block a malicious domain are all skills that security teams should have.
When feasible, think about locking down important accounts: Attackers frequently raise access to the admin domain level before deploying ransomware to spread the malware throughout a network. In the active directory, teams should set up highly secure, emergency-only accounts that are only used when other operational accounts are momentarily disabled as a precaution or rendered inaccessible due to a ransomware assault.
Install EDR on every endpoint: The fastest method for both public and private sector enterprises to combat the ransomware plague continues to be endpoint detection and response (EDR).
