RA World
RA World is a ransomware group with a financial motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 20 countries, including the United States and India. It uses 14 MITRE ATT&CK techniques.
Also known as
- Ragroup
- Techniques
- 14
- Exploited CVEs
- No CVE data
- First seen
- Apr 22, 2023
- Last seen
- Dec 28, 2024
- Record updated
Who They Target.
Sectors · 15
Labelsransomware
How They Operate · MITRE ATT&CK.
14 techniques across 8 of 15 tacticsResource Development·
Initial Access1
T1091
Replication Through Removable Media
Replication Through Removable Media
Persistence1
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion4
T1027
Obfuscated Files or Information
Obfuscated Files or Information
T1070
Indicator Removal
Indicator Removal
T1222
File and Directory Permissions Modification
File and Directory Permissions Modification
T1490
Inhibit System Recovery
Inhibit System Recovery
Credential Access·
Discovery1
T1426
System Information Discovery
System Information Discovery
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact1
T1486
Data Encrypted for Impact
Data Encrypted for Impact
Other1
T1420
File and Directory Discovery
File and Directory Discovery
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →CVE-2021-26855Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.Exploitedhigh
Arsenal · Malware And Tools.
- Babukmalware
- RA Groupmalware
- Raworldmalware
- Bluetooth Stack for Windows by Toshibatool
- Impackettool
- NPStool
- ProcDumptool
- PsExectool
Indicators Of Compromise.
TLP:AMBER+STRICT- Hash
b667c985e344a4a16bc64d18f4fda14e - Hash
95639f8080597118182c89cb63bd2415
209 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout RA World.
RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.