Global RA World Ransomware Gang Hits Germany
RA World ransomware gang targets 5 victims in Germany. The hackers have published the data and profile of 2 of them, but the other 3 are still unknown. That suggests that the negotiations are still ongoing or that the victims haven’t contacted the hackers yet.
- All victims got 5 days at their disposal to contact the hackers for negotiations
- Two of the victims either surpassed their time limit or refused to negotiate, causing the hackers to expose their data publicly
- RA World was previously known as RA group and it became public in July 2022
- The gang uses the double-extortion tactic and exploits weak credentials to infiltrate their victims
Ransomware attacks have been on a growing trend since the beginning of 2023. Most attacks are conducted by veteran gangs, but many are also linked to newly-formed groups. RA World is fairly well-established in the ransomware sphere.
While the organization doesn’t appear to be highly active, the hackers are good at what they do. In many cases, victims didn’t realize the breach until the ransomware note hit them. RA World also uses encryption to deny the victims access to their systems.
The double-extortion strategy is fairly common in the ransomware sphere. The tactic involves using a powerful encryptor to scramble the victim’s data and make it unreadable. The victim cannot recover it without the decryption key.
This is only obtainable during negotiations if the victim decides to negotiate, which most don’t. When it comes to the stolen data, nothing is certain. The hackers claim that they will delete it if the ransom is paid, but records speak against that.
As evidence shows, most ransomware gangs save the data for themselves for later use. Many others share or sell it to other ransomware gangs or simply leak it on the Dark Web for other advantages.
How Dangerous is RA World?
According to some reports, RA World is quite the capable organization, using advanced tactics and tools to speed up infiltration, avoid detection, and boost data exfiltration. This already paints it as a resourceful and dangerous group.
The hackers are also resilient and adaptable, allowing them to tackle potential threats effectively. This is especially valuable in today’s climate when the FBI, along with their European counterparts, have started to crack down on ransomware gangs.
Today’s attack is proof that ransomware gangs in general have become more capable and confident. While RA World is known as a ruthless group, they rarely target multiple victims at once. Especially high-value ones.
So, what should you do if and when targeted by a gang like RA World? The most important piece of advice you can get is this: do not negotiate and do not pay the ransom. Paying the ransom doesn’t guarantee anything other than you losing money.
The hackers may publish the stolen data anyway or share it with other malicious actors who will use it for their own purposes. This explains why those who choose to pay the ransom are often hit multiple times a year.
At least until they work on their cybersecurity or decide to no longer give in to the hackers’ pressure.
Our Mission
We believe security online security matters and its our mission to make it a safer place.
