From RA Group to RA World: Evolution of a Ransomware Group
Summary: The ransomware group RA Group, now rebranded RA World, has shown a noticeable uptick in activity since March 2024, with about 37% of all posts on its dark web leak site appearing since then. The group uses a multi-extortion scheme that exfiltrates sensitive data before encrypting it, and its leak site data shows it mainly hit healthcare organizations until mid-2024, when manufacturing became the most impacted sector.
What's compelling: RA World experimented with a "cost per customer" calculation, publicly posting lines such as "This company isn't willing to pay $0.5 per customer to protect their privacy" - a reputational lever aimed at customer-facing victims. Unit 42 also notes a low-confidence attribution tying the group's tooling and file-path conventions to the Chinese threat group BRONZE STARLIGHT, so the operators behind your incident may not be the ones the leak site names.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·