Royal Ransomware Leverages Qbot, Cobalt Strike to Rapidly Compromise Windows Domains

Key Takeaways

• The Royal ransomware group is employing a rapid, multi-stage attack chain combining Qbot and Cobalt Strike to quickly compromise Windows domains.
• Initial access is typically gained via spearphishing emails containing malicious attachments, leading to Qbot deployment.
• Attackers prioritize speed over stealth, leveraging legitimate Windows tools and elevated privileges to expand their foothold and exfiltrate data before encryption.
• The group was highly active in late 2022, listing nearly 60 victims on its leak site in November and December alone, with ransom demands often in the multi-million dollar range.
• Effective defense relies on robust logging, vigilant monitoring for suspicious PowerShell and service installations, and prompt isolation of compromised systems.

The Royal ransomware group has developed a highly effective strategy to escalate initial compromises into full-scale enterprise attacks across Windows domains. This approach combines an initial phishing-based foothold with sophisticated tools for rapid lateral movement and domain takeover, leading to widespread disruption.

Incident response teams have observed that the attackers first deploy Qbot to establish a presence within a victim’s network. Following this initial breach, they swiftly expand their access and control before initiating the encryption process. This rapid progression means that organizations often find themselves facing a pervasive attack that spreads much faster than anticipated.

The attack sequence typically commences with targeted spearphishing emails delivered to employees. These emails often contain malicious attachments that, when opened, execute Qbot through the Windows command shell. This provides the attackers with an initial point of control within the compromised system. Qbot’s use in hijacking business email conversations has made it a recurring threat in corporate environments.

Analysts at Invictus said in a report that their investigations into ransomware incidents revealed Royal’s reliance on speed. The group utilizes a combination of tools and legitimate Windows features to quickly transition from a single infected machine to a broader network compromise. This aggressive tactic has allowed Royal to remain highly active, with their leak site recording almost 60 new victims in November and December of 2022 alone. Responders caution that this figure likely underestimates the true scale of their operations, as not all victims are listed publicly. Previous reports also highlight Royal’s substantial ransom demands, frequently reaching multi-million dollar figures.

Royal Ransomware’s Toolset and Tactics

The Royal ransomware operators strategically deploy a dual-threat approach, initiating their attacks with Qbot as the primary backdoor, then leveraging encoded PowerShell commands to introduce Cobalt Strike. Qbot establishes persistence via a Windows Registry Run key, ensuring its continued presence, while Cobalt Strike is installed as a Windows service on multiple systems. This redundancy provides the attackers with multiple avenues for re-entry into the compromised environment, making detection and eradication more challenging.

Both Qbot and Cobalt Strike are further concealed by injecting them into legitimate Windows processes. This technique complicates detection efforts during incident response, particularly when investigations are time-sensitive. Cobalt Strike facilitates peer-to-peer communication through Windows named pipes, while both malware components maintain communication with their command-and-control servers over HTTPS. The adaptability of Cobalt Strike has made it a favorite among attackers for various Windows intrusion scenarios.

Lateral Movement and Reconnaissance

Upon acquiring privileged domain accounts, the Royal group exploits these credentials to navigate extensively across the network. They achieve this by mounting remote administrative shares from the initial compromised workstation and employing stolen credential hashes to access additional systems. Furthermore, the attackers utilize built-in Windows utilities to conduct reconnaissance, enumerating users, groups, domain trusts, and available network shares.

The reconnaissance phase is bolstered by tools like PowerSploit and AdFind, which assist the group in identifying local administrators and comprehensively mapping the domain structure. Analysis indicates that Royal prioritizes rapid progression over stealth. This means they are willing to trigger some security alerts if it expedites their path to full domain control, leaving minimal time for defenders to contain the intrusion.

Before initiating encryption, the group also engages in data exfiltration to cloud storage services. Observed instances show the use of legitimate applications such as Dropbox and MegaSync for these illicit transfers. This double-extortion tactic adds another layer of pressure on victims.

What You Should Do

• Enhance Windows Logging: Implement comprehensive logging for all Windows systems. Focus on collecting and reviewing logs related to scheduled tasks (Application Event Log), PowerShell activity, and Windows service installations (Event ID 7045).
• Monitor PowerShell Activity: Prioritize the investigation of any unusual PowerShell executions, especially encoded commands or unexpected script launches. Be particularly vigilant for PowerShell activity immediately following a phishing incident, as Royal frequently uses it for Cobalt Strike deployment and user account control bypasses.
• Centralize Service Installation Records: Collect and centralize Event ID 7045 logs to detect suspicious service creations. Cobalt Strike commonly employs Windows services for persistence, making this a critical detection point.
• Protect Privileged Accounts: Implement strong authentication mechanisms (e.g., multi-factor authentication) and strict access controls for all privileged accounts. Regularly audit these accounts for any unauthorized activity or compromise.
• Monitor Cloud Storage Usage: Implement monitoring for unauthorized installations or usage of cloud-transfer applications like Dropbox and MegaSync. These tools are often used by Royal for data exfiltration.
• Isolate Infected Hosts Immediately: Develop and practice incident response plans that emphasize rapid isolation of any suspected infected hosts. The speed of Royal’s attacks necessitates swift containment to prevent domain-wide compromise.
• Security Awareness Training: Conduct regular and comprehensive security awareness training for all employees, focusing on identifying and reporting spearphishing attempts and malicious attachments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.