Saturday, April 13, 2024

RA World Ransomware Attack Windows Using Hacked Domain Control & Anti-AV Tactics

Threat actors use hacked domain control to host malicious content by leveraging legitimate domains to evade detection by security measures. 

Anti-AV tactics are employed to bypass the antivirus software and tools that enable the execution of malicious code without detection.

Together, all these tactics enhance the stealth and effectiveness of cyber attacks, allowing threat actors to compromise systems and steal sensitive information more easily.

Recently, cybersecurity researchers at Trend Micro discovered that RA World (previously the RA Group) ransomware has been attacking Windows using hacked domains and Anti-AV tactics.

RA World Ransomware Attack

The RA World ransomware, once known as the RA Group, broke into global organizations in April 2023. 

Researchers identified that this ransomware group mainly targeted US firms, but besides the US firms, it also struck in-

  • Germany
  • India
  • Taiwan

This ransomware group mainly targets healthcare, insurance, and financial businesses.

RA World operators’ breach through compromised domain controllers allowed the components in SYSVOL to be dropped for GPO. 

The deployment of Stage1.exe via PowerShell indicated altered Group Policy settings enabling script execution.

The malware may have infiltrated Group Policy, allowing it to run on multiple machines within the domain.

Attack chain (Source – Trend Micro)

Here, Stage1.exe scans for the domain controllers by halting if conditions are met, like the matching host names.

It also checks for Finish.exe and Exclude.exe in %WINDIR%\Help, which indicates the past compromise or exclusion.

Stage1.exe (Source – Trend Micro)

Ransomware checks for Stage2.exe in %WINDIR%\Help.

If absent then it copies pay.txt and Stage2.exe from a hardcoded SYSVOL Path which indicates a targeted attack with a company domain name. 

This strategy involves initial payload presence on one machine, then execution on others via Group Policies which helps in revealing a multi-stage approach to compromise the network targeted.

  • T1543.003 – The program checks for safe mode, then creates MSOfficeRunOncelsls service with Stage2.exe, configuring it for Safe Mode with Networking. 
  • T1562.009 – It configures BCD for Safe Mode, starts the machine. If already in Safe Mode, Stage2.exe decrypts pay.txt to Stage3.exe, the ransomware payload. 
  • T1070.004 – After execution, cleanup deletes remnants and creates registry keys. 

In stage 3 the RA World ransomware (Stage3.exe) deploys and drops the Finish.exe which creates the mutex.

The ransom note includes a list of recent victims of extortion tactics.

Ransom note (Source – Trend Micro)

T1485 – RA World deploys SD.bat to wipe the Trend Micro folder by using WMIC for disk info and leaving a log.

Besides this, T1070 – After deletion, the ransomware removes Safe Mode with the Networking option. T1529 – It forcibly reboots the computer. 

Babuk ‘retired’ in 2021, but leaked source code fuels new threats like RA World. Combined with Ransomware-as-a-Service, this lowers the entry barrier for less skilled cyber criminals.


Here below we have mentioned all the recommendations:-

  • Limit administrative rights to employees.
  • Keep security products updated.
  • Back up essential data routinely.
  • Exercise caution with emails, attachments, URLs, and program execution.
  • Encourage users to report suspicious emails and files promptly.
  • Regularly educate users on social engineering risks.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles