Newly identified RA Group compromises companies in U.S. and South Korea with leaked Babuk source code
Summary: Cisco Talos identified a new ransomware actor, RA Group, which emerged in April 2023 and appears to use leaked Babuk source code, with a sample written in C++ and compiled on April 23, 2023. The group launched its data leak site on April 22, 2023, listed three victims on April 27 and another on April 28, and runs double extortion attacks that leak victim files if contact is not made within three days.
Why it matters: RA Group went from launching its leak site to naming its first victims in five days, and its ransomware reaches beyond the infected machine to encrypt files on remotely mapped drives and network shares via APIs like NetShareEnum and WNetEnumResourceW.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·