Royal and its successor BlackSuit were among the most damaging ransomware operations against US critical infrastructure between 2022 and 2025, and their operators did not disappear when the brand did. FBI and CISA describe BlackSuit as the evolution of Royal, with total ransom demands of more than 500 million US dollars, and the US Department of Justice announced the seizure of BlackSuit servers and domains in August 2025. Cisco Talos assesses with moderate confidence that the Chaos ransomware operation that appeared in 2025 is a rebrand of BlackSuit or is run by former members. This profile covers the group's lineage, targeting, techniques mapped to MITRE ATT&CK, how it abuses accounts and remote access tools, and the detections and controls that break its playbook. It is for SOC analysts, incident responders and infrastructure owners, and complements the wider Ransomware Groups Guide.
Key takeaways
- One lineage, several names: Royal (from early 2022) became BlackSuit (from mid 2023), and Talos links the 2025 Chaos operation to the same people, so defences should track behaviour, not brand.
- Phishing and RDP open the door: FBI and CISA name phishing as the most common initial access vector and RDP compromise as the second, at around 13.3% of incidents, with initial access brokers also selling VPN credentials from stealer logs.
- Legitimate accounts and tools do most of the work: the group uses RMM software, valid admin accounts, PsExec and Group Policy changes to spread and disable antivirus before encrypting.
- Partial encryption and data theft: the encryptor encrypts only a chosen percentage of each file to move fast, after data is stolen with tools such as RClone for double extortion.
- Disruption is not the end: the July 2025 takedown seized four servers and nine domains, but the successor uses email flooding and vishing, so help desk and remote support controls matter as much as patching.
Who they are (names and aliases)
| Name | Active period | What sources say |
|---|---|---|
| Zeon (encryptor) | 2022 | HHS HC3 reports the operators first used the BlackCat encryptor, then their own Zeon encryptor with a Conti-like ransom note, before rebranding as Royal |
| Royal (MITRE ATT&CK S1073) | Early 2022 to about June 2023 | ATT&CK records Royal as first appearing in early 2022, with an ESXi-targeting version observed in February 2023; HC3 links the operators to the former Conti "Team One" |
| BlackSuit | Mid 2023 to July 2025 | FBI and CISA updated advisory AA23-061A in August 2024 to describe BlackSuit as the evolution of Royal, sharing numerous coding similarities with improved capabilities |
| Chaos | 2025 onwards | Cisco Talos assesses with moderate confidence that Chaos is a BlackSuit rebrand or run by former members, based on encryption parameters, ransom note structure and tooling |
HC3 describes the operators as experienced criminals from earlier groups, which fits the consistent tradecraft across brands. Researchers have noted encryption and TTP similarities with Conti, recorded in ATT&CK as a possible connection between their operators. For how brands like this split and re-form, see the Ransomware Family Lineage and Rebrands Guide and the Conti Ransomware Profile Guide.
Targeting and motivation
- Motivation: financial. Ransom demands typically ranged from about 1 to 10 million US dollars in Bitcoin according to FBI and CISA, with the largest single demand at 60 million. Earlier HC3 reporting on Royal cited demands from 250,000 to over 2 million.
- Sectors: the Department of Justice lists critical manufacturing, government facilities, healthcare and public health, and commercial facilities among attacked critical infrastructure. HC3 called Royal a significant threat to the healthcare sector.
- Geography: primarily the United States, with victims elsewhere. Talos reports the successor Chaos leak site lists mostly US victims, with fewer in the UK, New Zealand and India.
- Pressure tactics: the ransom amount is not in the note; victims must make contact through a Tor site. FBI and CISA also report victims receiving phone calls and emails from the actors about the compromise.
Tactics and techniques (MITRE ATT&CK)
The table maps behaviour documented in AA23-061A and the ATT&CK Royal entry. Tool names are listed so you can hunt for them, not as an endorsement of their use.
| Tactic | Technique | Observed behaviour |
|---|---|---|
| Initial access | T1566 Phishing; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1078 Valid Accounts | Phishing (including callback phishing per HC3), RDP compromise, vulnerable public apps, VPN credentials bought from brokers |
| Command and control | T1219 Remote Access Tools; T1572 Protocol Tunneling | AnyDesk, LogMeIn, Atera; Chisel, Cloudflared, OpenSSH tunnels; Cobalt Strike, Brute Ratel, SystemBC |
| Credential access | T1003.001 LSASS Memory | Mimikatz and NirSoft password utilities |
| Discovery | T1087.002 Domain Account; T1135 Network Share Discovery; T1046 Network Service Discovery | AdFind, SharpShares, Advanced IP Scanner, SoftPerfect NetWorx |
| Lateral movement and execution | T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1569.002 Service Execution | RDP, SMB and PsExec; a legitimate admin account logging on to a domain controller |
| Persistence | T1136.002 Domain Account | Batch files create admin users |
| Defence impairment | T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs | GPOs changed to disable antivirus; PowerTool, GMER, NSudo; event logs deleted |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | RClone, Cobalt Strike and Brute Ratel used to stage and exfiltrate before encryption |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1489 Service Stop; T1059.012 Hypervisor CLI | Partial encryption, vssadmin shadow copy deletion, Restart Manager to free locked files, ESXi variant |
How they abuse identities and credentials
Royal and BlackSuit intrusions are, at their core, identity attacks that end in encryption. Four patterns recur:
- Bought or stolen remote access credentials: FBI and CISA note that initial access brokers may harvest VPN credentials from stealer logs. A VPN account without phishing-resistant MFA is effectively a front door for sale. See the Initial Access Brokers Guide.
- Service accounts for movement: in the 2023 City of Dallas attack, reporting on the city's after-action review says the attackers used a city service account to move through infrastructure and deploy remote management tools, stealing about 1.17 TB of data between 7 April and 2 May before encryption began on 3 May. Service accounts with broad rights, static passwords and no interactive logon monitoring are ideal for this. See the Service Account Security Guide.
- Domain admin and Group Policy: the advisory describes a legitimate admin account used to reach a domain controller over SMB, then GPOs modified to disable antivirus and batch files that create admin users and force policy updates. Control of Tier 0 identities turns every domain-joined machine into a target at once. See the Group Policy Security Guide.
- RMM tools as persistent identities: AnyDesk, Atera and similar tools create their own accounts and sessions outside your identity provider. The successor Chaos operation adds Quick Assist sessions obtained by phoning victims after flooding their inboxes. See the RMM Tool Security Guide and the Email Bombing and Help Desk Impersonation over Teams Guide.
Notable incidents
| Date | Victim or event | What is reported |
|---|---|---|
| April to May 2023 | City of Dallas (Royal) | Service account used for movement, 1.17 TB stolen, 230 servers damaged and 1,398 endpoints rebuilt; the City Council approved an 8.5 million US dollar restoration budget (The Record) |
| April 2023 | Ransom payment traced by US authorities | A victim paid 49.31 BTC, then about 1.45 million US dollars, part of which was later frozen and seized (Department of Justice) |
| June 2024 | CDK Global outage | BleepingComputer reported, citing multiple sources, that BlackSuit was behind the outage of the dealer software platform used across North America |
| 24 July 2025 | Coordinated takedown | US agencies with partners in the UK, Germany, Ireland, France, Canada, Ukraine and Lithuania took down four servers and nine domains; 1,091,453 US dollars in virtual currency seized (announced 11 August 2025) |
| July 2025 | Chaos emerges | Talos publishes its analysis of Chaos and its links to BlackSuit; observed demand of 300,000 US dollars with threats of DDoS and of informing clients and competitors |
Detection and defence
Detection priorities
| Signal | Data source | Notes |
|---|---|---|
| New RMM agent or tunnelling binary (AnyDesk, Atera, Cloudflared, Chisel) on a server | EDR, Sysmon Event ID 1, service creation Event ID 7045 | Alert on any RMM not on your approved list; servers rarely need one |
| Service account logging on interactively or over RDP | Security Event ID 4624 (logon types 2 and 10), 4672 | The Dallas pattern; service accounts should never do this |
| New domain admin or privileged group change | Event IDs 4720, 4728, 4732, 4756 | Batch files creating admin users show up here |
| GPO modification outside change windows | Event ID 5136 on groupPolicyContainer objects | Precedes estate-wide antivirus disablement |
| Security log cleared | Event ID 1102 | Rarely legitimate; treat as an incident |
| Shadow copy deletion | Process creation of vssadmin.exe with delete arguments | Late-stage signal: isolate immediately |
| Large outbound transfer to cloud storage | Proxy, firewall and EDR network logs; RClone process names and config files | FBI and CISA note the first hop is usually a US IP address, so geoblocking alone will not help |
Controls in priority order
- Close remote access gaps: require phishing-resistant MFA for administrators and MFA for VPN and webmail (as AA23-061A recommends), remove internet-exposed RDP, and patch known exploited vulnerabilities on edge systems first. See the Phishing-Resistant MFA Guide.
- Govern service and admin accounts: inventory service accounts, deny interactive and RDP logon rights, move to gMSA where possible, and use just-in-time admin access with tiering so domain admin credentials never touch workstations.
- Allowlist remote support tools: block unapproved RMM and tunnelling software with application control and network egress rules, and require named, MFA-protected accounts for approved ones.
- Harden the help desk: verify callers out of band before any Quick Assist or remote session, since the successor operation relies on vishing after email flooding.
- Protect Group Policy and logging: restrict GPO edit rights to a small Tier 0 group, alert on changes, and forward logs off-host so clearing them locally does not erase evidence.
- Make recovery independent: offline, encrypted, immutable backups that are tested regularly, with backup administration on separate identities. See the Backup Security and Immutable Backup Guide and, for hypervisors, the ESXi Ransomware Playbook.
Decision guidance: small organisations get most value from items 1, 3 and 6, ideally through a managed detection provider that can act out of hours (Dallas encryption began at 2 a.m.). Large estates should prioritise item 2, because Tier 0 and service account abuse is what turns a single foothold into an estate-wide outage. Test controls with a tabletop that follows the Dallas timeline: weeks of quiet exfiltration, then encryption at 2 a.m.
Metrics
- Share of remote access paths (VPN, RDP gateways, VDI) protected by phishing-resistant MFA.
- Number of service accounts with interactive logon rights (target: zero).
- Count of unapproved RMM installations detected per month and median time to removal.
- Mean time to detect a privileged group or GPO change outside change control.
- Restore test success rate for Tier 0 and business critical systems from immutable backups.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05; PR.PS-05; DE.CM-09; RS.MA-01 | Least privilege, preventing unauthorised software, monitoring, executing the response plan |
| NIST SP 800-53 Rev. 5 | AC-6(10); CM-7(5); SI-4; AU-12 | Privileged function limits, software allowlisting, monitoring and audit records |
| CIS Controls v8.1 | 5 Account Management; 6 Access Control Management; 11 Data Recovery; 13 Network Monitoring and Defense | Service accounts, MFA, backups and exfiltration monitoring |
| MITRE ATT&CK mitigations | M1032 Multi-factor Authentication; M1053 Data Backup | The two mitigations that most reduce impact |
Practitioner checklist
- Hunt for the AA23-061A tool list (AnyDesk, Atera, Chisel, Cloudflared, AdFind, RClone, PsExec) on servers and domain controllers.
- Confirm every VPN and remote access path enforces MFA, and administrators use phishing-resistant MFA.
- Remove interactive and RDP logon rights from all service accounts and alert on Event ID 4624 types 2 and 10 for them.
- Alert on privileged group changes, GPO modifications (5136) and Security log clearing (1102).
- Block unapproved RMM and tunnelling tools by application control and egress filtering.
- Require out-of-band caller verification before help desk staff start remote support sessions.
- Keep offline, immutable backups on separate identities and test restores of Tier 0 systems.
- Track successor brands (Chaos) in threat intelligence and map new reporting to the same detections.
Standards and references
- CISA and FBI: #StopRansomware: BlackSuit (Royal) Ransomware (AA23-061A)
- US Department of Justice: Coordinated disruption actions against BlackSuit (Royal) ransomware
- MITRE ATT&CK: Royal (S1073)
- HHS HC3: Royal and BlackCat Ransomware threat analysis
- Cisco Talos: Unmasking the new Chaos RaaS group attacks
- The Record: Dallas ransomware gang report
- BleepingComputer: CDK Global outage caused by BlackSuit ransomware attack
Related NHI Mgmt Group resources: Ransomware Groups Guide · Ransomware-as-a-Service Business Model Guide · Service Account Security Guide · Ransomware Response and Recovery Guide