“Royal”, a ransomware operation consisting of “a group of vetted and experienced ransomware actors from previous operations” and first discovered in January of 2022, has quickly begun adding companies to their victim list and demanding ransoms ranging from approximately $250,000 to over $2 million. Royal was first known under the name “Zeon” but has rebranded to Royal as of mid-September 2022. Royal is known to be a private group without affiliates, unlike the common Ransomware-as-a-Service (RaaS) structure. The operation does not have a leak site, but a sample has been uploaded to a public malware repository and victims are beginning to speak out about the operation. AdvIntel CEO Vitali Kremez, in combination with Bleeping Computer, laid out details of the operation’s tactics, techniques, and procedures (TTPs), as the group has been in the shadows for the majority of this year. Royal utilizes “callback phishing attacks” in which they impersonate food delivery and software providers, disguised as subscription renewal emails. From the phishing email, users are prompted to call phone numbers to “cancel the subscription” and, in turn, get socially engineered by the threat actors to install remote access software (which is utilized as initial access). This is not the only technique to gain initial access; one (1) victim has come forward stating the threat actor exploited a vulnerability in their custom web application. The Royal operation then deploys Cobalt Strike for persistence, harvests credentials, moves laterally, exfiltrates desired data, and encrypts all devices. A victim of a Royal cyberattack has also come forward stating that their virtual machines were targeted by directly encrypting the company’s virtual disk files (VMDK) and that ransom notes were printed from network printers or created on the victim Windows machines. The operation’s Tor negotiation site is present in the ransom note as usual and contains a simple chat functionality. Administrators should remain vigilant due to Royal having experienced actors supporting the operation and their rapid ramp-up within the last month. CTIX analysts will continue to monitor activity surrounding the Royal ransomware operation.