raworld

Executive Summary

The raworld threat actor, also known as ragroup, emerged in April 2023 and is linked to a custom variant of the Babuk ransomware. Primarily motivated by financial gain, this group has targeted organizations across various sectors with ransomware campaigns, employing extortion tactics and data theft. Their operations demonstrate medium sophistication, focusing on organizational disruption through encryption and financial demands.

Goals & Targeting

The raworld threat actor focuses on achieving financial gain through ransomware operations and extortion. Their targeting profile appears indiscriminate across sectors, with a notable focus on small to medium-sized enterprises (SMEs) due to their often-limited security defenses. The group's strategic objective is to maximize the number of victims in a short timeframe, leveraging quick deployment and encryption techniques to pressure organizations into paying ransoms. Their geographic targeting appears broad, though some concentrations may exist based on their operational approach.

The raworld threat actor, first identified in April 2023, operates as a cybercriminal group utilizing a custom variant of the Babuk ransomware. This group has demonstrated the ability to compromise numerous victims, employing extortion tactics such as encrypting systems and demanding ransoms for decryption keys. Their activities are centered on financial gain, with a particular focus on disrupting organizational operations through data encryption and theft. The raworld actors have targeted sectors including business services, healthcare, and manufacturing, leveraging both phishing campaigns and brute-force attacks to infiltrate networks. Once inside, they deploy their ransomware to encrypt files and systems, often exfiltrating sensitive data as an additional intimidation tactic. The group's operational timeline spans from 2023 to 2024, with victims numbering over 126 individuals identified so far.

Key Capabilities

• Custom Babuk ransomware variant deployment
• Spear-phishing campaigns with malicious attachments
• RDP brute-force attacks as an infection vector
• Data encryption targeting business-critical systems
• Exfiltration of sensitive data for extortion purposes
• Intimidation tactics including threatening data exposure
• Use of disposable communication channels for extortion demands

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The raworld group has demonstrated a rapid infection and extortion campaign pattern, targeting businesses with operational disruptions through ransomware. Their victims have included organizations in sectors such as business services, healthcare, and manufacturing. The group appears to favor quick campaigns without long-term infrastructure persistence, making their activity challenging to detect but also limiting their ability to maintain persistent access. Notable operations include the April 2023 emergence and a steady increase in victim count through late 2024.

IOC Patterns

• Ransomware infection via phishing emails with malicious attachments
• Exfiltration of sensitive data using cloud-based storage or messaging platforms
• Use of RDP brute-force attacks for initial access
• Deployment of custom Babuk ransomware variant components
• Encrypted files and folders targeting business-critical systems

Recommended Actions

• Enhance email security protocols to detect phishing attempts
• Conduct regular employee training on ransomware awareness
• Implement strong RDP access controls and use multi-factor authentication
• Monitor for unusual network activity indicative of extortion campaigns
• Establish offline backups and ensure they are securely isolated
• Use endpoint detection and response (EDR) solutions to monitor for known ransomware indicators

Suggested Tags