This new ransomware group is targeting big businesses - here’s what you need to know
RA Group ransomware is targeting big firms in the US and South Korea
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A newransomwarethreat actor has been detected targeting big businesses in hopes of equally large payouts.
Cybersecurity researchers from Talos uncovered a threat actor called RA Group which kicked off its operations in April 2023 using the Babuk source code, which was previously leaked, apparently by one of its former members.
So far, the group has successfully attacked three organizations in the US, and one in South Korea. It doesn’t seem to have an industry preference, as the victims were in manufacturing, wealth management, insurance, and pharmacy.
Personalized ransom notes
There’s nothing particularly unique about RA Group. It launches double extortion attacks, stealing sensitive data as it encrypts the systems, in hopes of motivating the victims to pay the ransom demand. Its website seems to be a work in progress, as the group is still making cosmetic changes. When it leaks the data, it discoses the name of the victim, a list of the stolen data, the total size, and the victim’s website.
The ransom note is personalized for each individual victim, the researchers added, claiming this, too, is standard practice among ransomware threat actors. What isn’t standard practice, however, is naming the victims in the executables, as well.
Hitachi Energy confirms data breach after being hit by Clop ransomware>Hatch Bank says 140,000 customers had data stolen after breach>Here’s our rundown of the best ID theft protection out there
The malware encrypts only parts of files, in order to move faster. After the encryption is complete, the files get the .GAGUP extension. The ransomware then deletes everything in the Bin with the API SHEmptyRecyclebinA, as well as volume shadow copy by executing the local Windows binary vssadmin.exe, an administrative tool used to manipulate shadow copies.
The ransomware does not encrypt all files, though. Some are left accessible so that the victims can contact the group easier. The non-encrypted files are necessary for the victims to download the qTox application, used to reach out to the attackers.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Scotland vs South Africa live stream: how to watch 2024 rugby union Autumn International online from anywhere
