Friday, June 14, 2024

New RA Hacker Group Attack Organizations in the U.S. & Threaten to Leak Data

The ‘RA Group’ is a recently emerged ransomware organization that is actively attacking the following companies in the United States and South Korea:-

  • Pharmaceutical companies
  • Insurance companies
  • Wealth management companies
  • Manufacturing companies

Cybersecurity researchers at Cisco Talos observed them employing the common ‘double-extortion’ technique by establishing a data leak website on the dark web to disclose compromised information and compel victims into paying the ransom.

RA Hacker Group

After going online on April 22nd, 2023, the ransomware group began publishing their first victims’ details on April 27th, displaying sample files, data types, and data links.

While apart from this, RA Group utilizes an encryptor derived from the leaked source code of the now-defunct Babuk ransomware.

Sentinel Labs recently disclosed that, following the leakage of Babuk ransomware source code on a Russian hacker forum in September 2021, at least nine ransomware groups had employed it to extend their attack surface to the following platforms:-

  • Linux
  • VMware ESXi

Apart from the ransomware groups identified in Sentinel Labs’ report, Cisco Talos has documented a timeline of attacks by various groups utilizing ransomware offshoots from the Babuk source code, such as:-

  • Rook
  • Night Sky
  • Pandora
  • Nokoyawa
  • Cheerscrypt
  • AstraLocker 2.0
  • ESXiArgs

RA Group distinguishes itself by employing custom ransom notes tailored for each targeted organization, along with using victim-specific executable names.

In contrast, their ransomware targets all logical drives and network shares, except for essential Windows system folders like boot and Program Files, encrypting specific directories.

RA Group employs intermittent encryption to prevent rendering the victim’s system inoperable and increase the chances of receiving ransom payments.

This risky technique alternates between encrypting and not encrypting sections of files, potentially enabling partial data recovery.

During the encryption process, RA Group’s encryptor employs the following two algorithms:-

  • curve25519
  • eSTREAM cipher hc-128

RA Group appends the “.GAGUP” file extension to encrypted files and ensures that volume shadow copies and Recycle Bin contents are deleted, making data restoration more challenging.

Ransom Payment Note

RA Group’s ransom note, named ‘How To Restore Your Files.txt,’ instructs the victim to communicate with the threat actors through the qTox messenger application to discuss the ransom payment.

In addition to providing a link to a repository with stolen files as evidence of the data breach, the ransom note specifies that if the victim does not initiate contact within three days, the RA Group will expose the stolen files of the victim.

Due to its recent emergence and limited number of victims, the methods employed by this ransomware operation to breach systems and propagate across networks remain unclear.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles