Malware

Royal Ransom (ELF)

Also known as: Royal · Royal_unix

According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.

Indicators of Compromise 6

Domain corp-connect[.]top Domain scan-security[.]top Domain sequrityupdate[.]top Domain supportsoft[.]top Domain system-connect[.]top Filename readme.chaos.txt

MITRE ATT&CK TTPs 8

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1090
Proxy
Command And Control
 T1204.002
Malicious File
Execution
 T1486
Data Encrypted for Impact
Impact
 T1543.003
Windows Service
Persistence
 T1566.002
Spearphishing Link
Initial Access

Source Articles

Microsoft Teams vishing attacks lead to Chaos ransomware attacks
Threat actors are conducting vishing attacks via Microsoft Teams, impersonating IT support staff to trick employees into granting remote access to corporate devices. These intrusions are part of campaign STAC4749, tracked by Sophos, which led to the deployment of Chaos ransomware in at least three organizations. The attackers used fake IT-themed domains and spoofed identities to initiate contact, then deployed remote management tools like RemSupp and PowerShell-based backdoors to establish persistence and move laterally. The campaign targeted primarily North American organizations, with attacks spanning from February to June 2026, and demonstrated rapid progression from initial access to ransomware encryption—sometimes within 17 hours.
bleeping-computer ·4h ago