RA Group: A New and Dangerous Ransomware Gang Targeting U.S. and South Korean Organizations.
A new ransomware group called RA Group is targeting organizations in the US and South Korea, using a double-extortion tactic and a custom ransom note for each attack. The group's encryptor is based on the leaked source code for the Babuk ransomware, and it uses intermittent encryption to speed up the encryption process. The ransom note requires victims to negotiate a ransom using qTox messenger, and the group threatens to publish stolen data on extortion sites if the ransom is not paid. It is unclear how the group breaches systems and spreads laterally on a network.
