---
title: Royal ransomware’s actors make high demands
description: Royal ransomware was first spotted in January 2022, targeting different corporations. This group does not provide ransomware-as-a-service. The attackers demand figures ranging from $250,000 to over $2 million from their victims.
canonical_url: https://www.acronis.com/en/tru/posts/royal-ransomwares-actors-make-high-demands/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

05 January 2023

# Royal ransomware’s actors make high demands

Royal ransomware was first spotted in January 2022, targeting different corporations. This group does not provide ransomware-as-a-service. The attackers demand figures ranging from $250,000 to over $2 million from their victims.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

## Summary

*   Discovered in 2022
*   Samples are PE64 executables, written in C/C++  
*   Discovers other computers in the local network, scans for network shares and deletes shadow copies  
*   Can be executed only with a specified ID given as an argument  
*   Can encrypt particular folders and percentages of file  
*   Encrypts files using AES and RSA algorithms from OpenSSL library  
*   Encrypted files have ‘.royal’ extension  

## Introduction

Royal ransomware was first spotted in January 2022, targeting different corporations. This group does not provide ransomware-as-a-service. The attackers demand figures ranging from $250,000 to over $2 million from their victims.

On December 1, 2022, Royal ransomware was used to attack the telecom provider Intrado, with the gang demanding $60 million in ransom. We have not yet seen the leaked data, but the criminals shared a ~50 MB archive with some stolen files (including passports and other documents) as proof of breach.

## Technical details

### Overview

The Royal ransomware sample (sha256:5fda381a9884f7be2d57b8a290f389578a9d2f63e2ecb98bd773248a7eb99fa2) is a PE64 executable, not packed or obfuscated and written in C/C++:

![Image 1: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/a69373841d3fe2ab88db392a2fab17ab.png)

### Execution

The Royal ransomware sample was developed as a console application. At the start of execution, it takes parameters using the _CommandLineToAtgW()_ function.

![Image 2: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/e1b2a62140bbc6dada8c778c29ebb3d1.png)

These arguments are:

*   -path — the path to files that must be encrypted
*   -id — 32-byte victim’s ID
*   -ep — encryption percentage of the file  

Royal ransomware requires the ID parameter — without it, encryption will not begin.

After receiving parameters, the malware deletes all volume shadow copies using the ‘vssadmin.exe’ tool. The interesting thing is that this operation occurs before checking the ID parameter, so even if this parameter was not provided (or is wrong), Royal deletes shadow copies from the system.

![Image 3: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/4f7e072127739cdf74bf473a7e1c04ec.png)

The ID parameter must be a 32-byte value. This is the only check of this ID, so any 32-character value in this parameter will cause the program to start the execution.

![Image 4: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/5d8ed9a8621a7ae3b6228b8d0491de69.png)

The next routine is to check if there are other computers on the network. To do this, it begins with use of the Winsock DLL and then retrieves the interface–to–IPv4 address mapping table using the _GetIpAddrTable()_ function.

![Image 5: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/9a9f21ff1efd6ad8836d57d4d35eebb3.png)

Royal then creates a socket that is bound to a specific transport-service provider with the _WSASocketW()_ function, using the following arguments:

*   **af** = 0x2 — AF_INET (The Internet Protocol version 4 (IPv4) address family)
*   **type** = 0x1 — SOCK_STREAM (A socket type that provides sequenced, reliable, two-way, connection-based byte streams with an OOB data transmission mechanism)  
*   **protocol** = 0x6 — IPPROTO_TCP (The Transmission Control Protocol (TCP))  
*   **g** = 0 – No group operation is performed  
*   **dwFlags** = 0x01 — WSA_FLAG_OVERLAPPED (Creates a socket that supports overlapped I/O operations)  

After that, the created I/O completion port is associated with a TCP socket using the _CreateIoCompletionPort()_ function.

![Image 6: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/81492d1cdc23dc434fa2545cd416576f.png)

Then it begins to connect to other hosts on the network via port 445:

![Image 7: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/af4fd88910d22a8fa841611a0d2f53af.png)

![Image 8: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/e890243439b2e472f8025e0156602d23.png)

Royal can enumerate all available shares on the system using the ‘NetShareEnum’ function call. It will scan shares, and if the found name matches with the “ADMIN$” or “IPC$” strings, it will skip them during encryption.

![Image 9: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/b7e127ccfa7ada27ff3e28728e2245fc.png)

### File encryption

Once executed, Royal adds a stored list of extensions to the exclusion list. The strings are encoded in HEX format in reverse order. The decrypted strings look as follows:

0x7400610062002Ei64 – **.bat**0x6C006C0064002Ei64 – **.dll**0x6500780065002Ei64 – **.exe**0x7400610062002Ei64 – **.lnk****.royal**

In addition to file extensions, it excludes some folders from encryption:

![Image 10: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/856e8f376b8ce3cefd070c195d439db2.png)

To prevent the use of targeted files by other applications, Royal restarts the ‘explorer.exe’ process using Restart Manager API calls.

![Image 11: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/c49859986e1aaf7b102cdbaaee153f27.png)

![Image 12: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/1515491ec99087fbb8074321732601c0.png)

Before starting the encryption process, Royal checks the system information to know how many threads it can spawn. Threads will be started with the ‘sub_7FF6C88F870’ function start address.

![Image 13: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/6eee7a6522e968dc4ca81ccf6a6af6d4.png)

This function contains the main encryption routine. First, it loads an RSA public key hardcoded in the sample.

![Image 14: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/7628f2f0017e9f24b1b7bb6007c8d8a6.png)

It loads these modules, which are part of the OpenSSL crypto library.

![Image 15: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/0ec1c915c22af79193b11c41ef98d3ef.png)

Royal obtains all available logical drives in the system with _GetLogicalDrives()_ function and drops a ransom note titled “README.txt” on each found drive.

![Image 16: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/eae598557bf4a619598cdcc9e9e80640.png)

Then, it starts searching files using the _FindFirstFileW()_ and _FindNextFileW()_ functions. When an appropriate file is found, it reads the content with _ReadFile()_ and encrypts it using AES-256 algorithm from the OpenSSL library. All encrypted files get ‘.royal’ extension.

![Image 17: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/d63cf728680378cae20fdba02d1e0501.png)

Royal also writes encryption key, file size, and percentage of encrypted data (‘0x64’ = 100%) to the footer at the end of the file.

![Image 18: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/d9733dc1494579e64873ea354b019581.png)

### Ransom note

The ransom note contains a URL to contact criminals that includes the victim’s ID, which was provided as a command line argument.

![Image 19: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/d42d76b5806881f7e479121d8d204235.png)

### Data leak site

Because the ID was chosen randomly, the URL to the victims' leak site is not valid. The data leak site suggests contacting the criminals.

![Image 20: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/18f5fa9ce1d7ac7bb546057809f04e2d.png)

## Conclusion

The Royal ransomware group started its operations in the beginning of 2022, and has successfully breached various companies while demanding high ransoms.

The ransomware uses the OpenSSL library to encrypt users’ files. It can search for other computers on the local network, encrypt files in shared folders, delete shadow copies and terminate the ‘explorer.exe’ process to obtain access to files. It must be executed with provided 32-byte ID as an argument, and it can encrypt specific folders and even percentages of the file. All encrypted files get the ‘.royal’ extension. The encryption key, file size, and encryption percentage are added to the end of the file.

## Detected by Acronis

![Image 21: Royal ransomware’s actors make high demands](https://staticfiles.acronis.com/images/content/86c0ac71a66b22f4c77b8bfe8992d363.png)

## IoCs

### Files

**SHA256**5fda381a9884f7be2d57b8a290f389578a9d2f63e2ecb98bd773248a7eb99fa2

### Network indicators

**URL**http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/[Unique victim ID]

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)