The ‘RA Group’ is a recently emerged ransomware organization that is actively attacking the following companies in the United States and South Korea:-
Cybersecurity researchers at Cisco Talos observed them employing the common ‘double-extortion’ technique by establishing a data leak website on the dark web to disclose compromised information and compel victims into paying the ransom.
After going online on April 22nd, 2023, the ransomware group began publishing their first victims’ details on April 27th, displaying sample files, data types, and data links.
While apart from this, RA Group utilizes an encryptor derived from the leaked source code of the now-defunct Babuk ransomware.
Sentinel Labs recently disclosed that, following the leakage of Babuk ransomware source code on a Russian hacker forum in September 2021, at least nine ransomware groups had employed it to extend their attack surface to the following platforms:-
Apart from the ransomware groups identified in Sentinel Labs’ report, Cisco Talos has documented a timeline of attacks by various groups utilizing ransomware offshoots from the Babuk source code, such as:-
RA Group distinguishes itself by employing custom ransom notes tailored for each targeted organization, along with using victim-specific executable names.
In contrast, their ransomware targets all logical drives and network shares, except for essential Windows system folders like boot and Program Files, encrypting specific directories.
RA Group employs intermittent encryption to prevent rendering the victim’s system inoperable and increase the chances of receiving ransom payments.
This risky technique alternates between encrypting and not encrypting sections of files, potentially enabling partial data recovery.
During the encryption process, RA Group’s encryptor employs the following two algorithms:-
RA Group appends the “.GAGUP” file extension to encrypted files and ensures that volume shadow copies and Recycle Bin contents are deleted, making data restoration more challenging.
RA Group’s ransom note, named ‘How To Restore Your Files.txt,’ instructs the victim to communicate with the threat actors through the qTox messenger application to discuss the ransom payment.
In addition to providing a link to a repository with stolen files as evidence of the data breach, the ransom note specifies that if the victim does not initiate contact within three days, the RA Group will expose the stolen files of the victim.
Due to its recent emergence and limited number of victims, the methods employed by this ransomware operation to breach systems and propagate across networks remain unclear.
Struggling to Apply The Security Patch in Your System? –
Try All-in-One Patch Manager Plus
The first instance of Redline using such a method is in a new variant of Redline Stealer malware that McAfee…
A threat actor reportedly sells a database containing 49 million user records from Dell, one of the world's leading technology…
A safe and trusted Google Play experience is our top priority. We leverage our SAFE (see below) principles to provide…
BlackBerry reported a new iOS LightSpy malware, but Huntress researchers found it to be a macOS variant targeting Intel or…
A new RAT malware has been discovered to be targeting Android devices. This malware is capable of executing additional commands…
A serious concern has arisen for iPhone users in the European Union as a newly discovered flaw in Apple's Safari…