Government Organizations Warn of Royal Attacks
This post is also available in: 
עברית (Hebrew)
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued an alert to warn organizations of the increasing threat posed by the Royal ransomware.
The Royal ransomware has been used in attacks since September 2022, targeting US and international organizations in numerous sectors, including critical infrastructure, communications, education, healthcare and public healthcare (HPH), and manufacturing.
The Royal ransomware operators have been observed making ransom demands ranging between $1 million and $11 million, in Bitcoin. However, they do not include ransom amounts and payment instructions in the initial ransom note but instruct victims to contact them via a Tor website.
For initial access, Royal ransomware operators rely on phishing, remote desktop protocol (RDP), exploitation of vulnerabilities in public-facing applications, and initial access brokers, the FBI and CISA warn in their advisory
On infected systems, the FBI has found numerous batch files that add a new admin user, update group policies, create registry keys and execute the ransomware, monitor the encryption process, and delete files after the encryption has been completed.
Organizations are advised to implement and maintain a recovery plan that includes keeping multiple, separate backups of their data, to secure all accounts with strong and unique passwords, to implement multi-factor authentication, to implement network segmentation, to use network monitoring tools for identifying abnormal activity, to audit accounts and disable unused ports and services, and to keep all software and operating systems updated.
As reported on by Securityweek.com.
Prepared to dive into the world of futuristic technology? Attend INNOTECH 2023, the international convention and exhibition for cyber, HLS and innovation at Expo, Tel Aviv, on March 29th-30th
Interested in sponsoring / a display booth at the 2023 INNOTECH exhibition? Click here for details!
