Threat Intelligence Tarot
Vol. II · 133
Criminal (Russian-speaking, Conti-aligned)
★★★★★
risk 5/5
✦ The Crowned Lock ✦
Royal / BlackSuit
Royal Ransomware · BlackSuit · DEV-0569 (early) · Conti-aligned
Critical infrastructureHealthcareManufacturingGovernmentEducation
Active since ~2022 · Extortion, Financial gain
The Crowned Lock declared itself royalty after Conti's abdication — same court, new heraldry, same dungeons full of municipal databases. The seal on the ransom note matters less than the keys it holds.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆City of Dallas attack disrupting municipal services (May 2023)
- ◆$275M+ in cumulative ransom demands across 350+ victims (CISA estimate)
- ◆Callback phishing leading to remote-access tool deployment
- ◆Rebrand from Royal to BlackSuit (mid-2023)
Defenses
- ▸Immutable backups with isolated recovery environmentsCIS Control 11 ↗
- ▸Remote management tool inventory and allowlistingNIST CSF: ID.AM ↗
- ▸Callback phishing awareness in user security trainingNIST CSF: PR.AT ↗
- ▸Tested incident response and ransomware tabletop exercisesNIST SP 800-61 ↗
Reversed: Their Weakness
Backup immutability, callback phishing awareness, and remote-access tool inventories collapse the playbook this crown depends on. The throne is rented from defenders' inattention.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.