Log in Request a demo

Ransomware group profile

Royal

Also known as BlackSuit

Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit.

  • Rebranded

In short

Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit. The advisory says BlackSuit is the evolution of Royal and shares numerous coding similarities with it. In August 2025 the US Justice Department announced the takedown of BlackSuit (Royal) servers and domains.

Profile MapRansomware Group
  1. StatusRebrandedas reported
  2. Other Names1names in public reportsBlackSuit
  3. Entry Routes4ways inPhishing · Exposed Remote Desktop · Initial access brokers
  4. Defences7first steps listedPatch known exploited flaws · Use phishing-resistant MFA

Overview

Royal is a ransomware operation that, by CISA’s account, was used from about September 2022 to June 2023 under that name. MITRE ATT&CK says it first appeared in early 2022, so the sources differ by a few months. CISA and the FBI published advisory AA23-061A on March 2, 2023. They have updated it four times. The update of August 7, 2024 announced that Royal actors had rebranded as BlackSuit, and the text now uses “BlackSuit” except for older Royal activity.

What makes it distinct

The advisory says BlackSuit shares numerous coding similarities with Royal and has shown improved capabilities. Both use partial encryption, where the attacker chooses what percentage of each file to scramble. A lower share on large files helps them avoid detection and makes the attack much faster. MITRE adds that Royal uses multiple threads, and that a version aimed at ESXi servers (the software that runs virtual machines) was seen in February 2023.

Tools and how they move inside

The advisory lists Mimikatz and Nirsoft password utilities for credentials, tunnelling tools such as Chisel and PuTTY, and remote tools such as AnyDesk, LogMeIn and Atera. The actors used RDP, PsExec and SMB to move sideways, and used SystemBC and Gootloader to load more tools. To take data out they repurpose the penetration testing tool Cobalt Strike and the malware Ursnif/Gozi, and also use RClone and Brute Ratel.

Encryption and impact on systems

The advisory lists .royal as the extension on Royal-encrypted files and names the BlackSuit ransom note readme.BlackSuit.txt. The actors delete shadow copies with vssadmin.exe. MITRE ATT&CK adds that Royal uses esxcli to list and stop running virtual machines, and encrypts with the OpenSSL library and AES256.

Detection

The advisory includes a YARA rule aimed at the obfuscated DLLs, RSA functions and XOR decoders, and tells defenders to log and report all network traffic.

Scale

The advisory says ransom demands have typically ranged from about 1 million to 10 million US dollars, paid in Bitcoin. It states that BlackSuit actors have demanded over 500 million US dollars in total, and that the largest single demand was 60 million. It says they are willing to negotiate, and that the amount is not in the first ransom note. The Justice Department says attacks have targeted critical manufacturing, government facilities, healthcare and public health, and commercial facilities, among other critical infrastructure sectors.

Law-enforcement action

On August 11, 2025 the Justice Department announced coordinated actions against BlackSuit (Royal). They included the takedown of four servers and nine domains on July 24, 2025, with agencies from the United Kingdom, Germany, Ireland, France, Canada, Ukraine and Lithuania. It also unsealed a warrant to seize virtual currency worth 1,091,453 US dollars at the time. The department traces that sum to a ransom paid in April 2023 by one victim, which it does not name. The sources opened for this page do not say whether the group moved to another name after the takedown, so this page makes no claim about it.

Royal and BlackSuit key dates
  1. Early 2022Royal first appearsMITRE ATT&CK dates the first appearance of Royal to early 2022.
  2. September 2022Royal in useCISA says Royal was used from approximately September 2022 through June 2023.
  3. February 2023ESXi versionMITRE records a Royal version that also targets ESXi servers.
  4. March 2, 2023Advisory publishedCISA and the FBI publish AA23-061A.
  5. April 2023Ransom paidThe Justice Department traces seized funds to a ransom paid by one victim around April 4, 2023.
  6. November 13, 2023Advisory updatedThe advisory is updated with new tactics and indicators.
  7. January 9, 2024Funds frozenPart of that ransom is frozen at a virtual currency exchange.
  8. August 7, 2024Rebrand announcedThe advisory is updated to say Royal actors rebranded as BlackSuit.
  9. July 24, 2025TakedownFour servers and nine domains are taken down.
  10. August 11, 2025AnnouncementThe Justice Department announces the actions and a virtual currency seizure warrant.

At a glance
Also called
BlackSuit (rebrand)
Advisory
AA23-061A, FBI and CISA
Ransom range
About 1 to 10 million US dollars
Total demanded
Over 500 million US dollars
Largest demand
60 million US dollars
Takedown
July 24, 2025
Status
Rebranded, then infrastructure disrupted

Also known as

  • BlackSuit

How they get in

  1. 01

    Phishing

    The advisory says phishing is among the most successful routes. Victims installed malware from emails with malicious PDF files or from malvertising, meaning malicious online adverts.

  2. 02

    Exposed Remote Desktop

    Remote Desktop Protocol compromise is the second most common route, at around 13.3% of incidents per the advisory.

  3. 03

    Vulnerable public-facing applications

    The FBI has seen the actors get in by exploiting vulnerable internet-facing applications. The advisory names no CVE for Royal or BlackSuit.

  4. 04

    Initial access brokers

    Third-party reporting cited by the advisory says the actors may use brokers who sell access, including VPN credentials harvested from stealer logs.

How they extort

Double extortion, per the advisory: data is stolen before encryption, then published to a leak site if the ransom is not paid. The ransom note holds no amount. Victims must contact the actors through a Tor address. The advisory also reports phone and email contact with victims.

Who they target

  1. 01

    Manufacturing

    See the industry page
  2. 02

    Government and public sector

    See the industry page
  3. 03

    Healthcare

    See the industry page
  4. 04

    Retail and commercial facilities

    See the industry page

How to defend

  1. Patch known exploited flaws

    Prioritize patching known exploited vulnerabilities in internet-facing systems.

  2. Use phishing-resistant MFA

    Require it for administrator accounts, and standard MFA for all other services where possible, especially webmail and VPNs.

  3. Segment the network

    Segmentation controls traffic between parts of the network and limits how far ransomware can spread.

  4. Deploy EDR and monitoring

    EDR tools are particularly useful for spotting lateral connections between hosts. Log and report network traffic.

  5. Keep separate backups

    Keep multiple copies of data and servers in a physically separate, segmented and secure place. The actors delete volume shadow copies.

  6. Train users on phishing

    Staff should recognize and report phishing emails, the most common route in.

  7. Test your controls

    Test security tools against the ATT&CK techniques in the advisory and tune them from the results.

Questions

What is Royal ransomware?

Royal is a ransomware operation that, by CISA's account, was used from about September 2022 to June 2023 under that name. In August 2024 an advisory update said Royal actors had rebranded as BlackSuit.

What is the link between Royal and BlackSuit?

The joint FBI and CISA advisory AA23-061A says BlackSuit is the evolution of Royal and shares numerous coding similarities with it. Both use partial encryption to work faster and avoid detection.

How does Royal get into networks?

The advisory says phishing is among the most successful routes, followed by Remote Desktop compromise at around 13.3% of incidents. The actors also exploit vulnerable internet-facing applications and may use initial access brokers.

How much ransom does Royal demand?

The advisory says demands have typically ranged from about 1 million to 10 million US dollars, paid in Bitcoin, with over 500 million demanded in total and 60 million as the largest single demand.

Was Royal or BlackSuit taken down?

The Justice Department announced on August 11, 2025 coordinated actions against BlackSuit (Royal), including a takedown of four servers and nine domains on July 24, 2025.

What file extension does Royal or BlackSuit use?

The advisory lists .royal as the extension on Royal-encrypted files, and names the BlackSuit ransom note readme.BlackSuit.txt.

How can I defend against Royal and BlackSuit?

The advisory recommends patching known exploited flaws first, phishing-resistant MFA for administrators, network segmentation, offline backups with regular backup and restore checks, and disabling macros by default.

In our research

  1. Cyber compliance calendar 2026 and 2027: key dates October 2026
  2. UK Cyber Security and Resilience Bill: status in 2026 October 2026
  3. APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT January 2026
  4. WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
  5. Top 10 Most Significant Data Breaches Publicly Listed on the Dark Web, 2023 to 2025 October 2025
  6. Mustang Panda: Persistent Threat of a China aligned Espionage Group September 2025

Sources

  1. #StopRansomware: BlackSuit (Royal) Ransomware (AA23-061A) CISA, FBI
  2. Justice Department Announces Coordinated Disruption Actions Against BlackSuit (Royal) Ransomware Operations US Department of Justice
  3. Royal, Software S1073 MITRE ATT&CK

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more