Trend Micro examined and uncovered “an extremely high degree of similarity” between the recently surfaced BlackSuit group and the Royal ransomware group. They share approximately 98% similarity in functions, 99.5% similarity in code blocks, and 98.9% similarity in jump instructions, as witnessed on BinDiff, a comparison tool for binary files. Experts also found eerie similarities between Royal Win32 and BlackSuit Win32 variants.