Royal Spider

Russian Federation


ROYAL SPIDER is the adversary behind the development and operations of the Royal Ransomware-as-a-Service (RaaS). The RaaS succeeds the short-lived Zeon ransomware, which was likely privately operated. The adversary operates a DLS in combination with victim-specific negotiation pages. Royal ransomware has versions for Windows and Linux/ESXi. ROYAL SPIDER is likely the developer of BlackSuit ransomw...

Community Identifiers



  • EoweN3IF5TYPcC9


  • wUrVmT6S

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.