Royal Ransomware Leverages Qbot and Cobalt Strike for Rapid Domain Compromise
Royal ransomware operators are rapidly compromising Windows domains by combining Qbot for initial access with Cobalt Strike for lateral movement and domain control, outpacing defender response times.
Royal ransomware has evolved its tactics, employing a potent combination of Qbot for initial access and Cobalt Strike for swift lateral movement and domain control, enabling rapid and widespread compromise of Windows environments. This strategy allows the threat actors to move from a single infected workstation to full domain takeover in a timeframe that significantly challenges incident response capabilities.
The attack chain typically begins with spearphishing emails, a common vector for delivering malware. Once a user opens a malicious attachment, Qbot is deployed, establishing persistence through the Windows Registry. This initial foothold is then leveraged to deploy Cobalt Strike, often executed via encoded PowerShell commands. To evade detection, Cobalt Strike is frequently installed as a Windows service and injected into legitimate system processes, making its presence harder to identify during an investigation.
Analysts from Invictus observed that Royal ransomware operators prioritize speed and efficiency, utilizing multiple tools and native Windows functionalities to achieve rapid network-wide compromise. This approach, while potentially triggering some security alerts, is favored for its effectiveness in quickly gaining privileged domain accounts. The group's activity was particularly high in late 2022, with their leak site listing nearly 60 victims in just two months, though incident responders believe this number to be an undercount.
Following the deployment of Cobalt Strike, attackers utilize stolen credentials and built-in Windows utilities for reconnaissance and lateral movement. They mount remote administrative shares from compromised systems and use credential hashes to access additional machines. Tools like PowerSploit and AdFind are employed to map the domain, identify local administrators, and gather information on user groups and domain trusts, all contributing to a swift understanding of the network topology.
Royal ransomware operators favor a direct, aggressive approach, accepting that some security alerts may be generated in exchange for achieving full domain control quickly. This rapid progression leaves defenders with minimal time to contain the intrusion before widespread encryption or data exfiltration occurs. The group has also been observed exfiltrating data to cloud storage services like Dropbox and MegaSync before deploying ransomware.
To counter this evolving threat, security teams are advised to enhance their Windows logging capabilities and prioritize the investigation of suspicious activities. Key areas of focus include reviewing scheduled tasks in the Application Event Log, monitoring PowerShell activity for encoded commands or unusual service installations, and investigating unexpected Windows service creations, particularly Event ID 7045. Centralizing service installation records is crucial as Cobalt Strike commonly relies on services for persistence.
Defenders should also treat unusual PowerShell activity as a high-priority indicator, especially when it follows a phishing event or involves encoded commands. The use of PowerShell for executing Cobalt Strike and performing user account control bypasses highlights its critical role in the attack chain. Protecting privileged accounts and isolating infected hosts promptly are also essential containment measures.
Ultimately, the effectiveness of Royal ransomware's strategy lies in its ability to rapidly escalate from a single point of compromise to a domain-wide crisis. By combining well-established tools like Qbot and Cobalt Strike with a focus on speed and leveraging native Windows features, the group presents a significant challenge to even well-resourced security operations.