⚠
RAWorld
ransomware1 mutex signatures
[BASIC_INFORMATION]
FAMILY_NAME:
RAWorld
CATEGORY:
RANSOMWARE
DESCRIPTION:
RA World, formerly known as RA Group, is a ransomware group that uses a multi-extortion scheme, exfiltrating data before encryption. The group is known to use a variant of the Babuk ransomware.
ALIASES:
RA GroupRA World
TAGS:
ransomwarebabuk_variantmulti-extortiondata_exfiltration
[MUTEX_SIGNATURES](1)
[MUTEX_01]
For whom the bell tolls, it tolls for thee
ANALYST: @adhikara13 DATE: 2025-07-16
[QUICK_ACTIONS]
[THREAT_INTELLIGENCE]
ATTRIBUTION:
⚠RA Group
FIRST_OBSERVED:
2023
[SIGMA_RULE]
[STATISTICS]
MUTEX_COUNT:1
THREAT_ACTORS:1
ALIASES:2
TAGS:4
CATEGORY:RANSOMWARE
Malware profile loaded successfully