Royal
Software · ATTACK:enterprise:S1073
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1073",
"title": "Royal",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1073",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--802a874d-7463-4f2a-99e3-6a1f5a919a21",
"external_id": "S1073",
"domain": "enterprise",
"created": "2023-03-30T20:25:37.761Z",
"modified": "2025-10-21T03:24:27.158Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA Royal AA23-061A March 2023",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a"
},
{
"source_name": "Cybereason Royal December 2022",
"url": "https://www.cybereason.com/blog/royal-ransomware-analysis"
},
{
"source_name": "Kroll Royal Deep Dive February 2023",
"url": "https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"
},
{
"source_name": "Trend Micro Royal Linux ESXi February 2023",
"url": "https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"
},
{
"source_name": "Microsoft Royal ransomware November 2022",
"url": "https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11e07c1f-4b28-459f-92db-ab4ebe1c5740
Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023 · Trend Micro Royal Linux ESXi February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fe61df4-3a67-4c46-87f5-771a42323e53
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a
Cybereason Royal December 2022 · Trend Micro Royal Linux ESXi February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1059.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--395f4ec5-caaf-4cf5-9700-8033dcf81334
Trend Micro Royal Linux ESXi February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c1dbc6c-c608-4745-8cd2-863b4d56fabe
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--455ad18f-00a1-4ac4-a77b-abb26a68996e
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5364714b-0c15-4453-9b09-7fcca3d3db01
CISA Royal AA23-061A March 2023 · Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--855347b7-4f23-4565-8738-f21a014c75cc
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--857773f6-4b86-4483-8344-2331c241d472
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0144271-c8e4-4cb3-b977-17b750c7193d
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d942783e-906f-4d2c-963b-1cc2f8429ff1
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1da5aff-cead-46b6-a45c-ab7f4e650e05
Cybereason Royal December 2022 · Trend Micro Royal Linux ESXi February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb4bcd20-8bd2-4dd2-bbac-f784058ee9dc
CISA Royal AA23-061A March 2023 · Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0a36615-b3eb-47d5-8a2a-9d7429643a0a
Cybereason Royal December 2022ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1aa297a-1b61-4bfc-9e4b-18b4b82b4d8c
Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023 · Trend Micro Royal Linux ESXi February 2023