Ransomware.live - Group : Raworld

Ransomware Group:

Raworld

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.

Sites

Favicon	Title	Available	Last Visit	FQDN	Screenshot
	RA World	🟢	2025-01-18 03:01:27.176543	raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion	📸
	RA World	🔴	2025-01-11 19:17:24.551934	pa32ymaeu62yo5th5mraikgw5fcvznnsiiwti42carjliarodltmqcqd.onion	N/A

Yara Rules

Click here to open yara rules

Ransom Note(s)

Click here to see Ransom Note(s)

Activity over time

Worldmap

137 Victims

Watertown Public Schools

Ransomware Group:

Discovery Date: 2024-12-28 11:49

Sector: Education

[AI generated] Watertown Public Schools is a school district located in Watertown, Massachusetts. It serves a diverse community, offering education from pre-kindergarten through 12th grade. The district is committed to fostering an inclusive environment and emphasizes academic excellence, critical thinking, and social-emotional development. Schools include elementary, middle, and high schools, focusing on preparing students for future success.

Victim: | Group:

STEG Stadtentwicklung

Ransomware Group:

Discovery Date: 2024-12-28 11:48

Sector: Not Found

[AI generated] STEG Stadtentwicklung is a company focused on urban development and planning. It specializes in revitalizing urban areas, creating sustainable urban environments, and promoting community involvement in development projects. The company collaborates with municipalities, private investors, and stakeholders to design and implement projects that enhance urban life, ensuring economic, social, and environmental sustainability.

Victim: | Group:

Ire-Omba SpA

Ransomware Group:

Discovery Date: 2024-12-28 11:47

Sector: Manufacturing

[AI generated] Ire-Omba SpA is an Italian company specializing in the production and export of wooden products, particularly timber and finished wood components. With a focus on sustainability and quality, they source wood responsibly and serve various industries, including construction and furniture. The company is known for its expertise in processing and treating wood to meet diverse client specifications.

Victim: | Group:

Gr****up

Ransomware Group:

Discovery Date: 2024-12-22 22:24

Sector:

Victim: | Group:

De****ep

Ransomware Group:

Discovery Date: 2024-12-22 22:23

Sector:

Victim: | Group:

Ri****uk

Ransomware Group:

Discovery Date: 2024-12-22 22:22

Sector:

Victim: | Group:

NE****IT

Ransomware Group:

Discovery Date: 2024-12-22 22:21

Sector:

Victim: | Group:

Wa****ls

Ransomware Group:

Discovery Date: 2024-12-22 22:20

Sector:

Victim: | Group:

ST****ng

Ransomware Group:

Discovery Date: 2024-12-22 22:19

Sector:

Victim: | Group:

Compass Communications

Ransomware Group:

Discovery Date: 2024-12-11 19:01

Sector: Business Services

[AI generated] Compass Communications is a telecommunications company based in New Zealand. It offers a range of services, including broadband internet, mobile phone plans, and home phone services. Known for competitive pricing and customer-focused service, Compass Communications caters to both residential and business customers, aiming to provide reliable connectivity solutions across the country.

Victim: | Group:

NTrust

Ransomware Group:

Discovery Date: 2024-12-04 14:50

Sector: Technology

[AI generated] NTrust is a global real estate and facilities management services company that specializes in lease administration, lease accounting, and technology solutions. They offer services such as transaction management, data abstraction, and portfolio management. NTrust leverages advanced software and analytics to optimize real estate operations, helping clients streamline processes and improve decision-making.

Victim: | Group:

Co****ns

Ransomware Group:

Discovery Date: 2024-12-04 14:49

Sector:

Victim: | Group:

NT****st

Ransomware Group:

Discovery Date: 2024-12-02 01:53

Sector:

Victim: | Group:

Contrack Facilities Management

Ransomware Group:

Discovery Date: 2024-11-27 21:05

Sector: Business Services

[AI generated] Contrack Facilities Management is a company specializing in comprehensive facilities management services. They provide solutions for property maintenance, operations, and support services. Their offerings often include building maintenance, cleaning, security, and energy management, tailored to enhance the efficiency and sustainability of client properties. They cater to various sectors, ensuring optimal facility performance.

Victim: | Group:

Ventana Micro Systems

Ransomware Group:

Discovery Date: 2024-11-27 21:04

Sector: Technology

[AI generated] Ventana Micro Systems is a technology company specializing in the development of high-performance RISC-V processors. The company focuses on delivering scalable and efficient computing solutions for data centers and edge computing applications. By leveraging the open RISC-V architecture, Ventana aims to provide innovative, customizable processors that balance performance, power efficiency, and flexibility.

Victim: | Group:

Lu****ng

Ransomware Group:

Discovery Date: 2024-11-27 21:03

Sector: Not Found

Victim: | Group:

Me****or

Ransomware Group:

Discovery Date: 2024-11-27 21:01

Sector: Not Found

Victim: | Group:

Co****nt

Ransomware Group:

Discovery Date: 2024-11-25 02:18

Sector: Not Found

Victim: | Group:

Gulf Energy Maritime

Ransomware Group:

Discovery Date: 2024-11-23 16:17

Sector: Energy

[AI generated] Gulf Energy Maritime is a prominent maritime shipping company based in the United Arab Emirates. It specializes in the transportation of crude oil, petroleum products, and chemicals. The company operates a modern fleet of tankers, ensuring safe and efficient delivery while adhering to high environmental and safety standards. It plays a critical role in the global energy supply chain.

Victim: | Group:

Ge****og

Ransomware Group:

Discovery Date: 2024-11-17 17:16

Sector: Not Found

Victim: | Group:

Gu****me

Ransomware Group:

Discovery Date: 2024-11-17 17:15

Sector: Not Found

Victim: | Group:

Orange County Pathology Medical Group

Ransomware Group:

Discovery Date: 2024-11-12 20:16

Sector: Healthcare

[AI generated] Orange County Pathology Medical Group is a healthcare organization specializing in pathology services. Located in Orange County, California, the group provides diagnostic services and laboratory testing to support patient care. Their team of skilled pathologists works closely with healthcare providers to deliver accurate and timely results, contributing to effective patient diagnosis and treatment.

Victim: | Group:

SK Gas

Ransomware Group:

Discovery Date: 2024-11-12 20:15

Sector: Energy

[AI generated] SK Gas is a South Korean company primarily involved in the liquefied petroleum gas (LPG) industry. It is a subsidiary of the SK Group, one of South Korea's largest conglomerates. SK Gas operates in the import, storage, and distribution of LPG, serving both domestic and international markets. The company also engages in energy-related services and infrastructure development, focusing on sustainable and innovative energy solutions.

Victim: | Group:

BULLONERIE GALVIT

Ransomware Group:

Discovery Date: 2024-10-31 11:25

Sector: Manufacturing

[IA generated] BULLONERIE GALVIT is a company specializing in the production and distribution of fasteners and metal components. Known for its high-quality standards, the company offers a wide range of products including bolts, nuts, and screws, catering to various industries such as construction and manufacturing. Their focus on innovation and customer service has established them as a trusted name in the sector.

Victim: | Group:

BU****IT

Ransomware Group:

Discovery Date: 2024-10-27 14:41

Sector: Not Found

Victim: | Group:

TR****GB

Ransomware Group:

Discovery Date: 2024-10-26 01:04

Sector: Not Found

Victim: | Group:

Matouk Bassiouny

Ransomware Group:

Discovery Date: 2024-10-25 13:18

Sector: Business Services

Matouk Bassiouny is a prominent law firm based in Cairo, Egypt, known for its expertise in arbitration, corporate law, and dispute resolution. The firm serves a diverse clientele, including multinational corporations and local businesses, offering legal services across various sectors. With a strong regional presence, Matouk Bassiouny is recognized for its skilled legal team and client-focused approach.

Victim: | Group:

Digital Engineering

Ransomware Group:

Discovery Date: 2024-10-24 23:16

Sector: Technology

Digital Engineering is a company specializing in innovative technology solutions and services. They focus on designing and developing digital systems that enhance business operations. Their offerings include software development, systems integration, and consulting services. With a team of skilled engineers, Digital Engineering aims to drive digital transformation and improve efficiency for their clients.

Victim: | Group:

Prince Pipes

Ransomware Group:

Discovery Date: 2024-10-23 23:13

Sector: Manufacturing

Prince Pipes and Fittings Limited is a leading Indian manufacturer of polymer pipes and fittings. Established in 1987, the company specializes in producing high-quality piping solutions for plumbing, irrigation, and sewage needs. With a strong distribution network across India, Prince Pipes offers a wide range of products, including CPVC, UPVC, and PPR pipes, emphasizing innovation and sustainability in its operations.

Victim: | Group:

P+B Team Aircargo

Ransomware Group:

Discovery Date: 2024-10-23 23:12

Sector: Transportation/Logistics

P+B Team Aircargo is a logistics company specializing in air freight services. They focus on providing efficient and reliable cargo solutions tailored to client needs. With expertise in handling various types of goods, they ensure timely and secure transportation. Their services often include customs clearance, tracking, and end-to-end logistics management, aiming to optimize the supply chain for businesses.

Victim: | Group:

Pr****es

Ransomware Group:

Discovery Date: 2024-10-20 12:09

Sector: Not Found

Victim: | Group:

Di**ng

Ransomware Group:

Discovery Date: 2024-10-20 12:08

Sector: Technology

Victim: | Group:

PB**ce

Ransomware Group:

Discovery Date: 2024-10-20 12:07

Sector: Financial

Victim: | Group:

Ma****ny

Ransomware Group:

Discovery Date: 2024-08-04 19:34

Sector: Manufacturing

Victim: | Group:

Ascent Group

Ransomware Group:

Discovery Date: 2024-07-28 18:10

Sector: Not Found

Victim: | Group:

Kusum Group of Companies

Ransomware Group:

Discovery Date: 2024-07-24 22:48

Sector: Healthcare

Victim: | Group:

TheLutheranFoundation

Ransomware Group:

Discovery Date: 2024-07-24 22:48

Sector: Not Found

Victim: | Group:

Melchers Singapore

Ransomware Group:

Discovery Date: 2024-07-24 22:47

Sector: Business Services

Victim: | Group:

As****fs

Ransomware Group:

Discovery Date: 2024-07-24 22:47

Sector: Not Found

Victim: | Group:

GWF Frankenwein

Ransomware Group:

Discovery Date: 2024-05-02 14:13

Sector: Agriculture and Food Production

Victim: | Group:

Reederei Jüngerhans

Ransomware Group:

Discovery Date: 2024-05-02 14:13

Sector: Transportation/Logistics

Victim: | Group:

Gr****en

Ransomware Group:

Discovery Date: 2024-05-02 14:12

Sector: Technology

Victim: | Group:

Me****ng

Ransomware Group:

Discovery Date: 2024-05-02 14:11

Sector: Not Found

Victim: | Group:

Po****

Ransomware Group:

Discovery Date: 2024-05-02 14:10

Sector: Healthcare

Victim: | Group:

Mainwein

Ransomware Group:

Discovery Date: 2024-04-24 16:21

Sector: Not Found

Victim: | Group:

charlesparsons (Attack again)

Ransomware Group:

Discovery Date: 2024-04-22 04:03

Sector: Manufacturing

Victim: | Group:

Ma****in

Ransomware Group:

Discovery Date: 2024-04-22 04:02

Sector: Not Found

Victim: | Group:

La****up

Ransomware Group:

Discovery Date: 2024-04-22 04:02

Sector: Technology

Victim: | Group:

UnivationTechnologies

Ransomware Group:

Discovery Date: 2024-04-16 03:29

Sector: Technology

Victim: | Group:

Autoglass

Ransomware Group:

Discovery Date: 2024-04-16 03:27

Sector: Business Services

Victim: | Group:

charlesparsons

Ransomware Group:

Discovery Date: 2024-04-16 03:26

Sector: Manufacturing

Victim: | Group:

Po****sa

Ransomware Group:

Discovery Date: 2024-04-16 03:25

Sector: Energy

Victim: | Group:

Gimex

Ransomware Group:

Discovery Date: 2024-04-12 00:14

Sector: Not Found

Victim: | Group:

Victor Fauconnier

Ransomware Group:

Discovery Date: 2024-04-12 00:13

Sector: Not Found

Victim: | Group:

Un****es

Ransomware Group:

Discovery Date: 2024-04-12 00:12

Sector: Business Services

Victim: | Group:

Al****ch

Ransomware Group:

Discovery Date: 2024-04-12 00:11

Sector: Agriculture and Food Production

Victim: | Group:

Se****bH

Ransomware Group:

Discovery Date: 2024-04-12 00:11

Sector: Technology

Victim: | Group:

Gi****ex

Ransomware Group:

Discovery Date: 2024-04-03 19:32

Sector: Technology

Victim: | Group:

Innomotive Systems Hainichen GmbH

Ransomware Group:

Discovery Date: 2024-04-03 02:56

Sector: Manufacturing

Victim: | Group:

KICO GROUP

Ransomware Group:

Discovery Date: 2024-04-02 22:26

Sector: Business Services

Victim: | Group:

Sterling Plumbing Inc

Ransomware Group:

Discovery Date: 2024-04-02 02:56

Sector: Manufacturing

Victim: | Group:

C&C Casa e Construção Ltda

Ransomware Group:

Discovery Date: 2024-04-02 02:56

Sector: Business Services

Victim: | Group:

TUBEX Aluminium Tubes

Ransomware Group:

Discovery Date: 2024-04-02 02:55

Sector: Manufacturing

Victim: | Group:

SchwarzGrantz

Ransomware Group:

Discovery Date: 2024-03-23 22:22

Sector: Not Found

Victim: | Group:

Title Management Inc

Ransomware Group:

Discovery Date: 2024-03-23 22:21

Sector: Financial

Victim: | Group:

Pascoe International

Ransomware Group:

Discovery Date: 2024-03-23 22:21

Sector: Healthcare

Victim: | Group:

Bisco Industries

Ransomware Group:

Discovery Date: 2024-03-21 00:36

Sector: Manufacturing

Victim: | Group:

Bluelinea

Ransomware Group:

Discovery Date: 2024-03-21 00:36

Sector: Healthcare

Victim: | Group:

Deepnoid

Ransomware Group:

Discovery Date: 2024-03-21 00:35

Sector: Technology

Victim: | Group:

Eastern Media International Corporation

Ransomware Group:

Discovery Date: 2024-03-21 00:34

Sector: Not Found

Victim: | Group:

Eyegene

Ransomware Group:

Discovery Date: 2024-03-21 00:33

Sector: Healthcare

Victim: | Group:

Insurance Providers Group

Ransomware Group:

Discovery Date: 2024-03-21 00:32

Sector: Financial

Victim: | Group:

Thaire

Ransomware Group:

Discovery Date: 2024-03-21 00:31

Sector: Business Services

Victim: | Group:

Decimal Point Analytics Pvt

Ransomware Group:

Discovery Date: 2024-03-21 00:31

Sector: Financial

Victim: | Group:

Wealth Enhancement Group

Ransomware Group:

Discovery Date: 2024-03-21 00:30

Sector: Financial

Victim: | Group:

Zurvita

Ransomware Group:

Discovery Date: 2024-03-21 00:29

Sector: Business Services

Victim: | Group:

Piex Group

Ransomware Group:

Discovery Date: 2024-03-21 00:28

Sector: Not Found

Victim: | Group:

Yuxin Automobile Co.Ltd

Ransomware Group:

Discovery Date: 2024-03-21 00:27

Sector: Manufacturing

Victim: | Group:

24/7 Express Logistics

Ransomware Group:

Discovery Date: 2024-03-21 00:26

Sector: Transportation/Logistics

Victim: | Group:

Aceromex

Ransomware Group:

Discovery Date: 2024-03-21 00:25

Sector: Manufacturing

Victim: | Group:

Chung Hwa Chemical Industrial Works

Ransomware Group:

Discovery Date: 2024-03-21 00:24

Sector: Manufacturing

Victim: | Group:

SUMMIT VETERINARY PHARMACEUTICALS LIMITED

Ransomware Group:

Discovery Date: 2024-03-21 00:24

Sector: Healthcare

Victim: | Group:

Informist Media

Ransomware Group:

Discovery Date: 2024-03-21 00:23

Sector: Technology

Victim: | Group:

ALAB laboratoria

Ransomware Group:

Discovery Date: 2024-03-21 00:23

Sector: Healthcare

Victim: | Group:

Di Martino Group

Ransomware Group:

Discovery Date: 2024-03-21 00:22

Sector: Business Services

Victim: | Group:

Rockford Gastroenterology Associates

Ransomware Group:

Discovery Date: 2024-03-21 00:22

Sector: Healthcare

Victim: | Group:

HALLIDAYS GROUP LIMITED

Ransomware Group:

Discovery Date: 2024-03-21 00:21

Sector: Financial

Victim: | Group:

Die Unfallkasse Thüringen

Ransomware Group:

Discovery Date: 2024-03-21 00:20

Sector: Government

Victim: | Group:

Wurzbacher

Ransomware Group:

Discovery Date: 2024-03-21 00:19

Sector: Not Found

Victim: | Group:

Ranzijn

Ransomware Group:

Discovery Date: 2024-03-21 00:19

Sector: Business Services

Victim: | Group:

SHORTERM GROUP

Ransomware Group:

Discovery Date: 2024-03-21 00:18

Sector: Transportation/Logistics

Victim: | Group:

In****GmbH

Ransomware Group:

Discovery Date: 2024-03-21 00:17

Sector: Not Found

Victim: | Group:

KI****UP

Ransomware Group:

Discovery Date: 2024-03-21 00:17

Sector: Technology

Victim: | Group:

St****nc

Ransomware Group:

Discovery Date: 2024-03-21 00:16

Sector: Technology

Victim: | Group:

Sc****tz

Ransomware Group:

Discovery Date: 2024-03-21 00:16

Sector: Business Services

Victim: | Group:

Di Martino Group

Ransomware Group:

Discovery Date: 2023-12-20 16:20

Sector:

Victim: | Group:

Rockford Gastroenterology Associates

Ransomware Group:

Discovery Date: 2023-12-20 16:19

Sector:

Victim: | Group:

HALLIDAYS GROUP LIMITED

Ransomware Group:

Discovery Date: 2023-12-20 16:19

Sector:

Victim: | Group:

Die Unfallkasse Thüringen

Ransomware Group:

Discovery Date: 2023-12-20 16:18

Sector:

Victim: | Group:

NIDEC GPM GmbH

Ransomware Group:

Discovery Date: 2023-12-20 16:18

Sector:

Victim: | Group:

ALAB laboratoria

Ransomware Group:

Discovery Date: 2023-11-26 05:36

Sector:

Victim: | Group:

Al****ia

Ransomware Group:

Discovery Date: 2023-11-19 04:13

Sector:

Victim: | Group:

Aceromex

Ransomware Group:

Discovery Date: 2023-11-17 08:32

Sector:

Victim: | Group:

Chung Hwa Chemical Industrial Works

Ransomware Group:

Discovery Date: 2023-11-17 08:31

Sector:

Victim: | Group:

SUMMIT VETERINARY PHARMACEUTICALS LIMITED

Ransomware Group:

Discovery Date: 2023-11-17 08:31

Sector:

Victim: | Group:

Informist Media

Ransomware Group:

Discovery Date: 2023-11-17 08:30

Sector:

Victim: | Group:

Yuxin Automobile Co.Ltd

Ransomware Group:

Discovery Date: 2023-11-07 07:03

Sector:

Victim: | Group:

Aceromex (Unpay-Start Leaking)

Ransomware Group:

Discovery Date: 2023-11-07 07:02

Sector:

Victim: | Group:

24/7 Express Logistics (Unpay-Start Leaking)

Ransomware Group:

Discovery Date: 2023-09-11 20:43

Sector:

Victim: | Group:

24/7 Express Logistics

Ransomware Group:

Discovery Date: 2023-09-07 22:16

Sector:

Victim: | Group:

Zurvita

Ransomware Group:

Discovery Date: 2023-09-04 20:39

Sector:

Victim: | Group:

Piex Group

Ransomware Group:

Discovery Date: 2023-09-04 20:38

Sector:

Victim: | Group:

Yuxin Automobile Co.Ltd (裕信汽車)

Ransomware Group:

Discovery Date: 2023-09-04 20:38

Sector:

Victim: | Group:

I****n

Ransomware Group:

Discovery Date: 2023-09-04 20:37

Sector:

Victim: | Group:

24****r

Ransomware Group:

Discovery Date: 2023-09-04 20:37

Sector:

Victim: | Group:

He****rk

Ransomware Group:

Discovery Date: 2023-09-04 20:36

Sector:

Victim: | Group:

Piex Group

Ransomware Group:

Discovery Date: 2023-09-01 04:19

Sector:

Victim: | Group:

Yuxin Automobile Co.Ltd(裕信汽車)

Ransomware Group:

Discovery Date: 2023-09-01 04:19

Sector:

Victim: | Group:

Zurvita

Ransomware Group:

Discovery Date: 2023-08-29 21:23

Sector:

Victim: | Group:

Y****e

Ransomware Group:

Discovery Date: 2023-08-29 21:22

Sector:

Victim: | Group:

2****r

Ransomware Group:

Discovery Date: 2023-08-29 21:22

Sector:

Victim: | Group:

I****n

Ransomware Group:

Discovery Date: 2023-08-29 21:21

Sector:

Victim: | Group:

P****X

Ransomware Group:

Discovery Date: 2023-08-04 18:05

Sector:

Victim: | Group:

Z****ta

Ransomware Group:

Discovery Date: 2023-08-04 18:05

Sector:

Victim: | Group:

Thaire

Ransomware Group:

Discovery Date: 2023-07-30 09:42

Estimated Attack Date: 2023-06-28

Sector:

Victim: | Group:

Bluelinea

Ransomware Group:

Discovery Date: 2023-07-30 09:41

Sector:

Victim: | Group:

Decimal Point Analytics Pvt

Ransomware Group:

Discovery Date: 2023-07-30 09:05

Sector:

Victim: | Group:

De****int

Ransomware Group:

Discovery Date: 2023-07-25 21:03

Sector:

Victim: | Group:

Bl****ea

Ransomware Group:

Discovery Date: 2023-07-24 06:06

Sector:

Victim: | Group:

Deepnoid

Ransomware Group:

Discovery Date: 2023-06-21 12:17

Sector:

Victim: | Group:

Target-9

Ransomware Group:

Discovery Date: 2023-06-21 12:16

Sector:

Victim: | Group:

Target-8

Ransomware Group:

Discovery Date: 2023-06-17 00:04

Estimated Attack Date: 2023-06-16

Sector:

Victim: | Group:

Eastern Media International Corporation

Ransomware Group:

Discovery Date: 2023-05-30 07:40

Estimated Attack Date: 2023-05-25

Sector:

Victim: | Group:

Insurance Providers Group

Ransomware Group:

Discovery Date: 2023-05-06 12:51

Estimated Attack Date: 2023-04-27

Sector:

Victim: | Group:

Wealth Enhancement Group

Ransomware Group:

Discovery Date: 2023-05-06 12:51

Estimated Attack Date: 2023-04-27

Sector:

Victim: | Group:

Bisco Industries

Ransomware Group:

Discovery Date: 2023-05-06 12:51

Estimated Attack Date: 2023-04-27

Sector:

Victim: | Group:

EyeGene

Ransomware Group:

Discovery Date: 2023-05-06 12:51

Estimated Attack Date: 2023-04-28

Sector:

Victim: | Group:

×

Infostealer information available for

Employees(s)	Customer(s)	Third Party Employee(s)

This information is provided by HudsonRock

×

rule ransomware_win_raworld {
    meta:
        id = "a9ed9c5a-7a0e-4c2e-90f4-d52f5589b2b8"
        version = "1.0"
        description = "Detects files related to stage 1 of a campaign from the ransomware group RA World."
        author = "Sekoia.io"
        creation_date = "2024-07-24"
        classification = "TLP:CLEAR"
        
    strings:
        $s1 = "Loder.exe" ascii fullword
        $s2 = "Stage2.exe" wide
        $s3 = "SYSVOL" wide
        $s4 = "Finish.exe" wide
        $s5 = "Exclude.exe" wide
        $s6 = "Stage3.exe" wide
        $s7 = "Pay.txt" ascii fullword
        $s8 = "RA World" ascii fullword
        $s9 = "Stage1.exe" ascii fullword
        
    condition:
        4 of them
}