RA World Ransomware

RA World ransomware, formerly known as RA Group, has emerged as a significant threat in the cyber landscape since its initial appearance in April 2023. This ransomware group, leveraging the leaked Babuk ransomware source code, employs a double-extortion model, exfiltrating sensitive data before encryption and threatening its public release if ransom demands are not met. Since March 2024, RA World has demonstrated a marked increase in activity, targeting a diverse range of sectors, with a notable recent focus on manufacturing after initially concentrating on healthcare. This shift, coupled with their evolving tactics, makes RA World a critical threat for security professionals to understand and defend against. One such tactic is phishing, which cannot be ruled out.

Origins & Evolution

RA World ransomware first came to light around April 2023, with initial reports by Cisco Talos in May 2023. The group, then known as RA Group, was identified as using a custom version of the leaked Babuk ransomware encryptor. This lineage is crucial, as the availability of the Babuk source code has fueled the development of several new ransomware variants since the 2020s. The group rebranded itself to RA World.

The group initially focused on targets in the United States and South Korea, spanning industries like manufacturing, wealth management, insurance, and pharmaceuticals. However, their reach quickly expanded to include Germany, India, Taiwan, and notably, Latin American healthcare organizations.

A key aspect of RA World's evolution is its apparent rebranding. While initially known as RA Group, with a dedicated data leak site, a new leak site under the name "RA World" appeared. Despite the different names and sites, the victim lists were identical, and in the same order, strongly suggesting that RA Group and RA World are, in fact, the same entity, possibly operating with different factions or under a unified leadership. The group updated the encrypted file extensions to ".RAWLD" and a ransom note was created.

The group's use of intermittent encryption, a technique that encrypts only parts of files, is a significant evolution. This tactic is designed to evade endpoint detection systems that rely on analyzing file I/O patterns. One way to further analyze file I/O patterns is by using security logging.

There has been some speculation, albeit with low confidence, about a potential connection between RA World and the Chinese threat group BRONZE STARLIGHT (also known as Emperor Dragonfly). Shared TTPs, such as the use of the NPS tool (developed by a Chinese developer), similar file paths, Impacket usage, and the Babuk base, have fueled this speculation. However, it's important to note that these overlaps could also be coincidental, stemming from the use of publicly available tools and leaked source code. The operating timezone (GMT+7 to GMT+9) and minor English errors in communications are further points of, weak, connection.

Tactics & Techniques

RA World's modus operandi is characterized by a multi-stage attack that leverages compromised infrastructure and refined techniques for maximum impact. The known steps of the operation of RA World are:

* Lateral Tool Transfer (T1105 - Stage1.exe): Stage1.exe plays a crucial role. It enumerates all domain controllers associated with the current domain and validates the domain name. It then iterates through each identified domain controller.

* Impacket Usage: The attackers utilized Impacket for lateral movement and remote command execution. This included copying the NTDS database, SAM hive, and the system registry. Understanding the Windows Registry structure helps in detecting such activities.

* If the first part of the domain controller's name matches the local machine's hostname (possible evasion of repeat infection).

* If Finish.exe exists in %WINDIR%\Help (suggests prior compromise).

* If Exclude.exe exists in %WINDIR%\Help (implies specific exclusion from infection).

* Stage 1 (Loader): Checks for "Exclude.exe," adds Stage2.exe to the SYSVOL share, and executes it.

* Stage 2: Delivers Babuk (Stage3.exe). If in safe mode, Babuk is decrypted and executed; otherwise, Stage2 writes itself as a service.

* Stage 3: A modified version of Babuk ransomware.

* Mutex name changed to "For whom the bell tolls, it tolls for thee".

* Ransom note filename changed to "Data breach warning.txt".

* Encrypted file extension changed to ".RAWLD".

* PDB path stripped.

* Creation of "C:\Windows\Help\Finish.exe" to signal encryption completion.

* Expanded exclusions during encryption.

* Service and Process Termination: Terminates specific services (e.g., backup solutions like Veeam, security software) and processes (e.g., database programs, Office applications) to ensure successful encryption.

* Volume Shadow Copy Deletion: Employs vssadmin.exe delete shadows /all /quiet to prevent file recovery.

Targets or Victimology

RA World's targeting strategy appears to be opportunistic rather than strictly focused on specific industries or geographic regions. However, some patterns have emerged:

Political Motivations: Primarily financial gain, typical of ransomware groups. There is currently no strong evidence linking RA World to specific nation-state objectives beyond the low-confidence speculation regarding a possible BRONZE STARLIGHT connection.

Potential Impact: Data breach (exposure of sensitive information), operational disruption, financial losses (ransom payment, recovery costs), and reputational damage. Understanding cyber incident response is very helpful.

Defenses

Protecting against RA World ransomware requires a multi-layered approach incorporating both preventative measures and robust detection and response capabilities:

Conclusion

RA World ransomware represents a significant and evolving threat. Its reliance on the leaked Babuk source code, its multi-stage attack methodology, its double-extortion tactics, and its recent surge in activity highlight the need for organizations to remain vigilant. While the potential connection to BRONZE STARLIGHT remains speculative, the group's demonstrated capabilities warrant serious attention. By implementing robust security controls, maintaining a strong security posture, and staying informed about the latest threat landscape, organizations can significantly reduce their risk of falling victim to RA World and similar ransomware threats. Proactive defense, combined with a well-defined incident response plan, is crucial for mitigating the potential impact of this emerging cyber threat. Using tools like Kali Linux can help proactively.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles: