How Royal Ransomware Used Qbot and Cobalt Strike to Take Over Windows Domains

Royal ransomware operators used Qbot, Cobalt Strike, stolen administrative credentials, and legitimate Windows features to turn a phishing infection into a domain-wide compromise. In documented incidents, the attackers moved quickly from one infected workstation to reconnaissance, lateral movement, data theft, and ransomware deployment.

The attack chain was documented in a December 2022 incident analysis by Invictus Incident Response. It should not be treated as evidence of a newly observed Royal campaign in 2026. However, the techniques remain relevant because they show how ransomware operators combine malware with tools already trusted by administrators.

Royal did not depend on a Windows vulnerability for domain takeover. Its operators used phishing, credential theft, PowerShell, remote administrative shares, scheduled tasks, services, and other normal Windows functions. This made early identity and behavior-based detection especially important.

Royal Ransomware Attack Chain at a Glance

Attack stage	Observed activity	Primary risk
Initial access	Spearphishing attachment or link delivered Qbot	Employee workstation compromise
Command and control	Qbot and Cobalt Strike communicated over HTTPS	Persistent remote attacker access
Execution	Encoded PowerShell commands launched Cobalt Strike	Malicious activity hidden inside common administration traffic
Persistence	Registry Run key, Windows services, and scheduled tasks	Multiple ways to regain access
Discovery	AdFind, PowerSploit, and Windows commands mapped the domain	Identification of privileged accounts and critical systems
Lateral movement	Administrative shares and pass-the-hash activity	Rapid spread across Windows systems
Exfiltration	Dropbox and MegaSync transferred stolen data	Double-extortion pressure
Impact	Ransomware encrypted files and added the .royal extension	Business disruption and recovery costs

Phishing and Qbot Provided the Initial Foothold

In the incident documented by Invictus, spearphishing emails targeted employees with malicious attachments. Opening the attachment caused Qbot, also known as Qakbot, to execute through the Windows command shell.

The researchers’ published TTP mapping also described an HTML smuggling chain. The lure delivered a password-protected archive containing an ISO file, a hidden payload, and a Windows shortcut that executed Qbot.

Royal affiliates did not rely on one delivery method. Microsoft’s analysis of Royal ransomware documented phishing links, malicious advertising, fake forum posts, contact-form abuse, and installers impersonating software such as TeamViewer, Zoom, and AnyDesk.

Qbot and Cobalt Strike Created Multiple Access Paths

Qbot acted as the first backdoor. The malware established persistence by placing its DLL in the current user’s Registry Run key, allowing it to start again when the user signed in.

The operators then executed Cobalt Strike through encoded PowerShell commands. Cobalt Strike is a legitimate security testing framework, but criminal groups frequently misuse cracked or unauthorized copies to control compromised computers.

Cobalt Strike was installed as a Windows service on several systems. Qbot and Cobalt Strike were also injected into legitimate Windows processes, giving the attackers several ways to maintain access if one component was removed.

Stolen Accounts Enabled Rapid Domain Takeover

After obtaining privileged domain credentials, the attackers moved from the first infected workstation to other systems. They mounted hidden C$ administrative shares and used stolen password hashes to authenticate without entering the original passwords.

The technical TTP list identifies pass-the-hash activity, Windows administrative shares, elevated PowerShell, and privileged domain accounts as important parts of the lateral movement process.

This approach allowed Royal operators to expand quickly across the environment. Invictus reported that the attackers prioritized speed over stealth and appeared willing to trigger some security alerts if doing so helped them reach full domain control.

• Privileged accounts allowed access to additional computers and servers.
• C$ shares provided a built-in path for remote file access.
• Pass-the-hash techniques reduced the need to recover plaintext passwords.
• Scheduled tasks helped execute commands with elevated privileges.
• Cobalt Strike named pipes supported peer-to-peer communication over SMB.

Windows Tools Helped the Attackers Map the Network

Royal operators used a mixture of built-in Windows commands and publicly available tools to understand the victim’s environment. This included collecting information about users, groups, local administrators, domain trusts, and accessible network shares.

AdFind supported Active Directory reconnaissance. PowerSploit functions helped locate systems where compromised users had local administrator rights and identify shares that could support lateral movement or data collection.

Because many of these tools also have legitimate administrative uses, defenders need context. A directory query may be harmless when an approved administrator runs it, but the same activity becomes suspicious when it follows a phishing alert, encoded PowerShell, or an unusual remote login.

Data Theft Came Before File Encryption

The operators used Dropbox and the MegaSync application to remove data from affected networks before deploying ransomware. This gave them an additional way to pressure victims by threatening to publish stolen information.

Scheduled tasks were used for persistence and ransomware deployment. Once launched, Royal encrypted files and added the .royal extension, disrupting access to business data across compromised systems.

Royal’s public leak site listed almost 60 victims during November and December 2022, according to the original investigation. The real total may have been higher because ransomware groups do not publish every victim, particularly when negotiations are continuing or a payment has been made.

Detection Opportunities for Windows Defenders

Security teams should investigate the earliest parts of this chain instead of waiting for widespread encryption. Suspicious PowerShell, new services, Registry Run key changes, and remote administrative-share access can provide warning before the final ransomware stage.

The Invictus response guidance recommends reviewing PowerShell activity, scheduled tasks, and unexpected Windows service installations. Centralizing these records makes it easier to find activity spread across several endpoints.

Detection rules should combine related events. A single service installation may be legitimate, but a service created shortly after a phishing infection and followed by SMB connections, named-pipe traffic, or credential misuse deserves immediate investigation.

Behavior to monitor	Why it matters	Recommended response
Encoded PowerShell commands	Royal used PowerShell to execute Cobalt Strike and other attack stages	Decode the command, identify the parent process, and isolate the host if malicious
Unexpected service installation	Cobalt Strike was installed as a Windows service	Verify the service name, binary path, creator account, and destination systems
Registry Run key modification	Qbot used the key for persistence	Inspect the referenced DLL or executable and review related sign-in activity
C$ share access	Administrative shares supported lateral movement	Check the source device, account privileges, and remote file operations
Unusual named-pipe traffic	Cobalt Strike used named pipes for peer-to-peer communication	Correlate pipe creation with SMB sessions and process activity
Dropbox or MegaSync on servers	Cloud applications were used for data exfiltration	Review transfer volume, destination accounts, and affected files
New scheduled tasks	Tasks supported persistence, elevation, and ransomware deployment	Inspect task actions, creators, execution times, and remote task creation

Royal Later Rebranded as BlackSuit

Royal’s name is now mainly relevant as part of the history of BlackSuit ransomware. An updated CISA and FBI advisory states that Royal actors rebranded their operation as BlackSuit.

Law enforcement later targeted that operation. The Justice Department said authorities seized four servers and nine domains on July 24, 2025. Officials also announced the seizure of cryptocurrency valued at approximately $1.09 million.

The operation involved agencies and partners from the United States, United Kingdom, Germany, Ireland, France, Canada, Ukraine, and Lithuania. The coordinated disruption affected infrastructure used to deploy ransomware, extort victims, and launder proceeds. A takedown does not guarantee that every affiliate or related operator has stopped working.

How Organizations Can Reduce the Risk

Organizations should assume that one compromised workstation can become a domain-level incident when privileged credentials are exposed. Separating administrative accounts from everyday email and web browsing reduces the chance that a phishing infection will immediately provide elevated access.

Microsoft’s defensive recommendations include phishing protection, attack surface reduction rules, tamper protection, credential hygiene, least privilege, and controls that prevent broad use of domain administrator accounts.

Organizations can also use the official BlackSuit and Royal guidance to review indicators, techniques, and mitigation priorities. Controls should be tested against behavior across the full intrusion chain, not only against the final ransomware executable.

• Require phishing-resistant multi-factor authentication for privileged and remote access.
• Use separate accounts and workstations for administrative tasks.
• Restrict PowerShell and script execution according to business needs.
• Disable or tightly control administrative shares where they are not required.
• Monitor service creation, scheduled tasks, Registry persistence, and remote SMB activity.
• Block unapproved cloud storage and synchronization tools on sensitive systems.
• Segment workstations, servers, backups, and management networks.
• Keep offline or otherwise isolated backups and test restoration regularly.
• Revoke active sessions and rotate exposed credentials during containment.
• Isolate suspected Qbot infections immediately and investigate the wider identity environment.

The Royal case remains a useful lesson in ransomware response. The damaging stage was not limited to file encryption. The larger failure occurred when a phishing infection gave attackers enough time and privilege to map the domain, steal data, and distribute their tools across the network.

FAQ