Tech & Innovation in Healthcare

On March 2, 2023, the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) released a joint Cybersecurity Advisory (CSA) regarding Royal ransomware. The agencies warn that malicious threat actors have used a Royal ransomware variant to compromise U.S. and international organizations since approximately September 2023.

Royal threat actors have demanded ransom payments ranging from $1 million to $11 million in Bitcoin. However, “[i] n observed incidents, Royal actors do not include ransom amounts and payment instructions as part of the initial ransom note,” the advisory reads. Instead, after the victim organization’s data is encrypted, a note appears requiring the victims to “directly interact with the threat actor” via a URL.

The FBI and CISA believe the ransomware variant has evolved from earlier versions that used “Zeon” as a loader. According to the CSA, this Royal ransomware variant “uses its own custom-made file encryption program.” Once the threat actors gain access to the victims’ networks, the threat actors disable antivirus software, transfer large amounts of data, and then unleash the ransomware and encrypt the victims’ systems. The agencies have found that Royal actors have targeted several organizations in critical infrastructure sectors, including Healthcare and Public Health (HPH).

To help reduce the risk and impact of ransomware events, the FBI and CISA encourage organizations to implement several mitigation measures. These measures include, but are not limited to:

• Put a recovery plan into effect.
• Make sure all accounts with passwords comply with National Institute for Standards and Technology (NIST) standards.
• Enact multifactor authentication (MFA).
• Update all firmware, software, and operating systems.
• Maintain offline data backups.
• Ensure backed up data is encrypted and immutable.

Additionally, if your organization does become a victim of ransomware, the agencies don’t encourage paying the ransom, “as payment does not guarantee victim files will be recovered.”