The RA Group Menace: Babuk Ransomware Source Code Fuels a New Breed of Cyber Threats

In recent years, ransomware attacks have been on the rise and show no signs of slowing down. A new threat actor has emerged, known as the RA Group, which has spawned its own locker variant using the leaked Babuk ransomware source code. Cisco Talos, a cybersecurity firm, has been tracking the group since at least April 22, 2021, and has raised alarm bells about the group’s rapidly expanding operations.

The Emergence of the RA Group

RA Group is a relatively new threat actor that has been in operation since at least April 2020. The group’s operations began with small-scale attacks on individual targets, but it has since expanded to include larger organizations and government agencies.

Expansion of Operations

In just a few short months, the RA Group has grown in size and capability. The group has been observed targeting organizations across various industries, such as healthcare, finance, and government. The group’s expansion has been attributed to its ability to adapt and improve its tactics in response to cybersecurity measures implemented by potential victims.

Double Extortion Attacks

RA Group, like many other ransomware gangs, uses a technique known as double extortion. This means that the group not only encrypts the victim’s files but also threatens to leak or sell sensitive data if the ransom is not paid. This approach puts additional pressure on victims to pay the ransom as they risk reputational damage or regulatory fines if sensitive data is exposed.

The RA Group operates a leak site where they publish the stolen data of their victims. The group uses this site to apply additional pressure on its victims to pay the ransom. By exposing the breach, the group hopes to persuade victims to pay up.

Intermittent encryption

The ransomware used by the RA Group employs an intermittent encryption technique to speed up the encryption process and evade detection. The group’s ransomware encrypts files in small batches, rather than all at once, making it more difficult for cybersecurity software to detect.

Deletion of Volume Shadow Copies and Recycle Bin files

In addition to intermittent encryption, RA Group’s ransomware is designed to delete volume shadow copies and the contents of the machine’s Recycle Bin. This makes it difficult for victims to recover their encrypted files without paying the ransom.

RA Group’s Unique Approach

One unique aspect of RA Group’s operations is that the group has been observed selling exfiltrated data on a secured TOR site. This sets the group apart from other ransomware gangs and adds another level of risk for victims. By selling the data, RA Group has the potential to profit even if victims refuse to pay the ransom.

Adoption of Babuk Ransomware code

RA Group is just one of many ransomware gangs that have adopted the Babuk ransomware source code. In a recent disclosure, the cybersecurity firm SentinelOne revealed that threat actors of varying sophistication are using the code to develop a dozen variants capable of targeting Linux systems.

Other ransomware gangs that have used Babuk’s source code

Other ransomware gangs, such as AstraLocker and Nokoyawa, have also used the Babuk ransomware code in the past year. Cheerscrypt, another ransomware strain which is based on Babuk, has been linked to a Chinese espionage actor called Emperor Dragonfly, who is known for operating short-lived ransomware schemes.

Cheerscrypt linked to Chinese espionage actor

Cheerscrypt, as mentioned earlier, has been linked to a Chinese espionage actor called Emperor Dragonfly. This has raised concerns about state-sponsored cyber warfare and espionage.

Discovery of New Ransomware Strains

In addition to the emergence of the RA Group, there have been reports of two other new ransomware strains: Rancoz and BlackSuit. BlackSuit is designed to target both Windows and VMware ESXi servers, while Rancoz is a fileless ransomware strain that uses a PowerShell script to execute commands without leaving traces on the system.

The constant evolution and release of new ransomware variants highlights the advanced skills and agility of threat actors. As cybersecurity measures and checks are implemented, ransomware gangs adjust their tactics and customize their ransomware, making it difficult for victims to protect themselves. The best defense against ransomware attacks remains preventative measures such as regular backups and employee training. However, as new strains continue to emerge, it is clear that organizations must remain vigilant and invest in robust cybersecurity measures.

Explore more

Why is LinkedIn the Go-To for B2B Advertising Success?

In an era where digital advertising is fiercely competitive, LinkedIn emerges as a leading platform for B2B marketing success due to its expansive user base and unparalleled targeting capabilities. With over a billion users, LinkedIn provides marketers with a unique avenue to reach decision-makers and generate high-quality leads. The platform allows for strategic communication with key industry figures, a crucial

Endpoint Threat Protection Market Set for Strong Growth by 2034

As cyber threats proliferate at an unprecedented pace, the Endpoint Threat Protection market emerges as a pivotal component in the global cybersecurity fortress. By the close of 2034, experts forecast a monumental rise in the market’s valuation to approximately US$ 38 billion, up from an estimated US$ 17.42 billion. This analysis illuminates the underlying forces propelling this growth, evaluates economic

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Embedded Finance Ecosystem – A Review

In the dynamic landscape of fintech, a remarkable shift is underway. Embedded finance is taking the stage as a transformative force, marking a significant departure from traditional financial paradigms. This evolution allows financial services such as payments, credit, and insurance to seamlessly integrate into non-financial platforms, unlocking new avenues for service delivery and consumer interaction. This review delves into the

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.