Microsoft Security Threat Intelligence has tracked activity from a threat actor known as DEV-0569 regarding the development of new tools to deliver the Royal ransomware.