The Royal ransomware group has been leveraging a combination of Qbot malware and Cobalt Strike to swiftly compromise Windows domains, turning initial breaches into widespread network disruptions. This tactic underscores the evolving sophistication of ransomware operations targeting enterprise environments.
The attack sequence typically begins with spear-phishing emails containing malicious attachments. Once an unsuspecting employee opens the attachment, Qbot is executed via the Windows command shell, establishing an initial foothold for the attackers. Qbot, also known as QakBot, has a history of being used in business email compromise schemes, as previously reported.
After securing access through Qbot, the attackers deploy Cobalt Strike using encoded PowerShell commands. Qbot ensures persistence by creating a Windows Registry Run key, while Cobalt Strike is installed as a Windows service across multiple systems. Both tools are injected into legitimate Windows processes, making detection challenging during incident response efforts.
Cobalt Strike utilizes peer-to-peer communication over Windows named pipes, and both tools communicate with command-and-control servers via HTTPS traffic. This method of communication has been observed in various Windows intrusion campaigns.
Once the attackers obtain privileged domain accounts, they move laterally through the network by mounting remote administrative shares from the initially compromised workstation and using stolen credential hashes to access additional systems. They employ built-in Windows utilities to enumerate users, groups, domain trusts, and network shares. Tools like PowerSploit and AdFind assist in reconnaissance, helping identify local administrators and map the domain structure.
The Royal ransomware group prioritizes speed over stealth, accepting that some security alerts may be triggered in their pursuit of rapid domain control. This aggressive approach leaves minimal time for defenders to contain the intrusion before significant damage occurs.
To detect and mitigate such attacks, security teams should monitor scheduled tasks in the Application Event Log, scrutinize PowerShell activity, and be vigilant for signs of unauthorized lateral movement within the network. Implementing robust email filtering, user education on phishing risks, and maintaining up-to-date endpoint detection and response solutions are critical in defending against these sophisticated ransomware campaigns.
The Royal ransomware’s use of Qbot and Cobalt Strike highlights the need for organizations to adopt a multi-layered security strategy. By understanding the tactics employed by such threat actors, businesses can better prepare and respond to potential ransomware incidents, minimizing the impact on their operations.
