RansomwareUnknown
Raworld
Raworld is a ransomware group, tracked by Brandefense. It targets 6 sectors, including Manufacturing and Finance, in 6 countries, including India and Germany. It uses 14 MITRE ATT&CK techniques.
Also known as
- Ragroup
- Techniques
- 14
- Exploited CVEs
- No CVE data
- First seen
- Apr 22, 2023
- Last seen
- Dec 28, 2024
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
14 techniques across 8 of 15 tacticsResource Development·
Initial Access1
T1091
Replication Through Removable Media
Replication Through Removable Media
Persistence1
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion4
T1027
Obfuscated Files or Information
Obfuscated Files or Information
T1070
Indicator Removal
Indicator Removal
T1222
File and Directory Permissions Modification
File and Directory Permissions Modification
T1490
Inhibit System Recovery
Inhibit System Recovery
Credential Access·
Discovery1
T1426
System Information Discovery
System Information Discovery
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact1
T1486
Data Encrypted for Impact
Data Encrypted for Impact
Other1
T1420
File and Directory Discovery
File and Directory Discovery
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →CVE-2021-26855Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.Exploitedhigh
Arsenal · Malware And Tools.
- Babukmalware
- RA Groupmalware
About Raworld.
RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.