Royal Spider

Russian Federation


ROYAL SPIDER is the adversary behind the development and operations of the Royal Ransomware-as-a-Service (RaaS). The RaaS succeeds the short-lived Zeon ransomware, which was likely privately operated. The adversary operates a DLS in combination with victim-specific negotiation pages. Royal ransomware has versions for Windows and Linux. CrowdStrike Intelligence identified Bitcoin activity in Octobe...

Community Identifiers



  • 9DgwqbltP8dov0E


  • NFaw0fdy

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.