Tuesday, April 1, 2025
Homecyber securityRA World Ransomware Attack Windows Using Hacked Domain Control & Anti-AV Tactics

RA World Ransomware Attack Windows Using Hacked Domain Control & Anti-AV Tactics

Published on

SIEM as a Service

Follow Us on Google News

Threat actors use hacked domain control to host malicious content by leveraging legitimate domains to evade detection by security measures. 

Anti-AV tactics are employed to bypass the antivirus software and tools that enable the execution of malicious code without detection.

Together, all these tactics enhance the stealth and effectiveness of cyber attacks, allowing threat actors to compromise systems and steal sensitive information more easily.

Recently, cybersecurity researchers at Trend Micro discovered that RA World (previously the RA Group) ransomware has been attacking Windows using hacked domains and Anti-AV tactics.

RA World Ransomware Attack

The RA World ransomware, once known as the RA Group, broke into global organizations in April 2023. 

Researchers identified that this ransomware group mainly targeted US firms, but besides the US firms, it also struck in-

  • Germany
  • India
  • Taiwan

This ransomware group mainly targets healthcare, insurance, and financial businesses.

RA World operators’ breach through compromised domain controllers allowed the components in SYSVOL to be dropped for GPO. 

The deployment of Stage1.exe via PowerShell indicated altered Group Policy settings enabling script execution.

The malware may have infiltrated Group Policy, allowing it to run on multiple machines within the domain.

Attack chain (Source – Trend Micro)

Here, Stage1.exe scans for the domain controllers by halting if conditions are met, like the matching host names.

It also checks for Finish.exe and Exclude.exe in %WINDIR%\Help, which indicates the past compromise or exclusion.

Stage1.exe (Source – Trend Micro)

Ransomware checks for Stage2.exe in %WINDIR%\Help.

If absent then it copies pay.txt and Stage2.exe from a hardcoded SYSVOL Path which indicates a targeted attack with a company domain name. 

This strategy involves initial payload presence on one machine, then execution on others via Group Policies which helps in revealing a multi-stage approach to compromise the network targeted.

  • T1543.003 – The program checks for safe mode, then creates MSOfficeRunOncelsls service with Stage2.exe, configuring it for Safe Mode with Networking. 
  • T1562.009 – It configures BCD for Safe Mode, starts the machine. If already in Safe Mode, Stage2.exe decrypts pay.txt to Stage3.exe, the ransomware payload. 
  • T1070.004 – After execution, cleanup deletes remnants and creates registry keys. 

In stage 3 the RA World ransomware (Stage3.exe) deploys and drops the Finish.exe which creates the mutex.

The ransom note includes a list of recent victims of extortion tactics.

Ransom note (Source – Trend Micro)

T1485 – RA World deploys SD.bat to wipe the Trend Micro folder by using WMIC for disk info and leaving a log.

Besides this, T1070 – After deletion, the ransomware removes Safe Mode with the Networking option. T1529 – It forcibly reboots the computer. 

Babuk ‘retired’ in 2021, but leaked source code fuels new threats like RA World. Combined with Ransomware-as-a-Service, this lowers the entry barrier for less skilled cyber criminals.

Recommendations

Here below we have mentioned all the recommendations:-

  • Limit administrative rights to employees.
  • Keep security products updated.
  • Back up essential data routinely.
  • Exercise caution with emails, attachments, URLs, and program execution.
  • Encourage users to report suspicious emails and files promptly.
  • Regularly educate users on social engineering risks.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Massive 400GB X (Twitter) Data Leak Surfaces on Hacker Forums

A colossal 400GB trove containing data from 2.873 billion X (formerly Twitter) users has...

PortSwigger Launches Burp AI to Enhance Penetration Testing with AI

PortSwigger, the makers of Burp Suite, has taken a giant leap forward in the...

Chord Specialty Dental Partners Data Breach Exposes Customer Personal Data

Chord Specialty Dental Partners is under scrutiny after revealing a data breach that compromised...

Kentico Xperience CMS XSS Vulnerability Allows Remote Code Execution

Kentico Xperience CMS, a widely used platform designed for enterprises and organizations, is under...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Microsoft Discovers GRUB2, U-Boot, and Barebox Bootloader Flaws with Copilot

Microsoft has disclosed the discovery of multiple critical vulnerabilities within the GRUB2, U-Boot, and...

Operation HollowQuill – Weaponized PDFs Deliver a Cobalt Strike Malware Into Gov & Military Networks

In a recent revelation by SEQRITE Labs, a highly sophisticated cyber-espionage campaign, dubbed Operation...

Earth Alux Hackers Use VARGIET Malware to Target Organizations

A new wave of cyberattacks orchestrated by the advanced persistent threat (APT) group Earth...