Skip to content
brandefense.io
Request A Demo
RansomwareFinancialAdvanced sophistication

Royal

Royal is a ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 8 countries, including the United States and India. It uses 47 MITRE ATT&CK techniques.

Also known as
  • royal Team
  • Team One
  • Royal Ransomware
Request IOC feedRequest ATT&CK export
Techniques
47
Exploited CVEs
No CVE data
First seen
Dec 15, 2022
Last seen
Dec 9, 2025
Record updated

Who They Target.

Sectors · 17
Countries · 8
Labelsransomware

About Royal.

According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.

Last updated Oct 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.