Saturday, March 2, 2024

New RA Hacker Group Attack Organizations in the U.S. & Threaten to Leak Data

The ‘RA Group’ is a recently emerged ransomware organization that is actively attacking the following companies in the United States and South Korea:-

  • Pharmaceutical companies
  • Insurance companies
  • Wealth management companies
  • Manufacturing companies

Cybersecurity researchers at Cisco Talos observed them employing the common ‘double-extortion’ technique by establishing a data leak website on the dark web to disclose compromised information and compel victims into paying the ransom.

RA Hacker Group

After going online on April 22nd, 2023, the ransomware group began publishing their first victims’ details on April 27th, displaying sample files, data types, and data links.

While apart from this, RA Group utilizes an encryptor derived from the leaked source code of the now-defunct Babuk ransomware.

Sentinel Labs recently disclosed that, following the leakage of Babuk ransomware source code on a Russian hacker forum in September 2021, at least nine ransomware groups had employed it to extend their attack surface to the following platforms:-

  • Linux
  • VMware ESXi

Apart from the ransomware groups identified in Sentinel Labs’ report, Cisco Talos has documented a timeline of attacks by various groups utilizing ransomware offshoots from the Babuk source code, such as:-

  • Rook
  • Night Sky
  • Pandora
  • Nokoyawa
  • Cheerscrypt
  • AstraLocker 2.0
  • ESXiArgs

RA Group distinguishes itself by employing custom ransom notes tailored for each targeted organization, along with using victim-specific executable names.

In contrast, their ransomware targets all logical drives and network shares, except for essential Windows system folders like boot and Program Files, encrypting specific directories.

RA Group employs intermittent encryption to prevent rendering the victim’s system inoperable and increase the chances of receiving ransom payments.

This risky technique alternates between encrypting and not encrypting sections of files, potentially enabling partial data recovery.

During the encryption process, RA Group’s encryptor employs the following two algorithms:-

  • curve25519
  • eSTREAM cipher hc-128

RA Group appends the “.GAGUP” file extension to encrypted files and ensures that volume shadow copies and Recycle Bin contents are deleted, making data restoration more challenging.

Ransom Payment Note

RA Group’s ransom note, named ‘How To Restore Your Files.txt,’ instructs the victim to communicate with the threat actors through the qTox messenger application to discuss the ransom payment.

In addition to providing a link to a repository with stolen files as evidence of the data breach, the ransom note specifies that if the victim does not initiate contact within three days, the RA Group will expose the stolen files of the victim.

Due to its recent emergence and limited number of victims, the methods employed by this ransomware operation to breach systems and propagate across networks remain unclear.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles