Wednesday, April 30, 2025
Homecyber securityRA World Ransomware Attack Windows Using Hacked Domain Control & Anti-AV Tactics

RA World Ransomware Attack Windows Using Hacked Domain Control & Anti-AV Tactics

Published on

SIEM as a Service

Follow Us on Google News

Threat actors use hacked domain control to host malicious content by leveraging legitimate domains to evade detection by security measures. 

Anti-AV tactics are employed to bypass the antivirus software and tools that enable the execution of malicious code without detection.

Together, all these tactics enhance the stealth and effectiveness of cyber attacks, allowing threat actors to compromise systems and steal sensitive information more easily.

- Advertisement - Google News

Recently, cybersecurity researchers at Trend Micro discovered that RA World (previously the RA Group) ransomware has been attacking Windows using hacked domains and Anti-AV tactics.

RA World Ransomware Attack

The RA World ransomware, once known as the RA Group, broke into global organizations in April 2023. 

Researchers identified that this ransomware group mainly targeted US firms, but besides the US firms, it also struck in-

  • Germany
  • India
  • Taiwan

This ransomware group mainly targets healthcare, insurance, and financial businesses.

RA World operators’ breach through compromised domain controllers allowed the components in SYSVOL to be dropped for GPO. 

The deployment of Stage1.exe via PowerShell indicated altered Group Policy settings enabling script execution.

The malware may have infiltrated Group Policy, allowing it to run on multiple machines within the domain.

Attack chain (Source – Trend Micro)

Here, Stage1.exe scans for the domain controllers by halting if conditions are met, like the matching host names.

It also checks for Finish.exe and Exclude.exe in %WINDIR%\Help, which indicates the past compromise or exclusion.

Stage1.exe (Source – Trend Micro)

Ransomware checks for Stage2.exe in %WINDIR%\Help.

If absent then it copies pay.txt and Stage2.exe from a hardcoded SYSVOL Path which indicates a targeted attack with a company domain name. 

This strategy involves initial payload presence on one machine, then execution on others via Group Policies which helps in revealing a multi-stage approach to compromise the network targeted.

  • T1543.003 – The program checks for safe mode, then creates MSOfficeRunOncelsls service with Stage2.exe, configuring it for Safe Mode with Networking. 
  • T1562.009 – It configures BCD for Safe Mode, starts the machine. If already in Safe Mode, Stage2.exe decrypts pay.txt to Stage3.exe, the ransomware payload. 
  • T1070.004 – After execution, cleanup deletes remnants and creates registry keys. 

In stage 3 the RA World ransomware (Stage3.exe) deploys and drops the Finish.exe which creates the mutex.

The ransom note includes a list of recent victims of extortion tactics.

Ransom note (Source – Trend Micro)

T1485 – RA World deploys SD.bat to wipe the Trend Micro folder by using WMIC for disk info and leaving a log.

Besides this, T1070 – After deletion, the ransomware removes Safe Mode with the Networking option. T1529 – It forcibly reboots the computer. 

Babuk ‘retired’ in 2021, but leaked source code fuels new threats like RA World. Combined with Ransomware-as-a-Service, this lowers the entry barrier for less skilled cyber criminals.

Recommendations

Here below we have mentioned all the recommendations:-

  • Limit administrative rights to employees.
  • Keep security products updated.
  • Back up essential data routinely.
  • Exercise caution with emails, attachments, URLs, and program execution.
  • Encourage users to report suspicious emails and files promptly.
  • Regularly educate users on social engineering risks.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Researchers Uncover SuperShell Payloads and Various Tools in Hacker’s Open Directories

Cybersecurity researchers at Hunt have uncovered a server hosting advanced malicious tools, including SuperShell...

Cyber Espionage Campaign Targets Uyghur Exiles with Trojanized Language Software

A sophisticated cyberattack targeted senior members of the World Uyghur Congress (WUC), the largest...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncover SuperShell Payloads and Various Tools in Hacker’s Open Directories

Cybersecurity researchers at Hunt have uncovered a server hosting advanced malicious tools, including SuperShell...

Cyber Espionage Campaign Targets Uyghur Exiles with Trojanized Language Software

A sophisticated cyberattack targeted senior members of the World Uyghur Congress (WUC), the largest...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...