cyber.hendryadrian.com
Threat Research · blog.talosintelligence.com

RA Group Ransomware Uses Leaked Babuk Code in Attacks on U.S. and South Korean Organizations

· Original article ↗

Summary

Cisco Talos reports that RA Group, active since April 2023, used ransomware derived from leaked Babuk source code in attacks on organizations in the U.S. and South Korea, combining file encryption with threats to leak stolen data.

Key points

  • Talos observed RA Group operating since at least April 22, 2023, and reported four victim organizations: three in the U.S. and one in South Korea.
  • Talos assesses with high confidence that the ransomware uses leaked Babuk source code, citing a shared mutex name.
  • The group uses double extortion: it encrypts files and threatens to publish exfiltrated data if victims do not respond within three days.
  • The C++ ransomware uses Curve25519 and HC-128, appends the .GAGUP extension, and encrypts only part of each file’s contents.
  • The malware deletes Recycle Bin contents and volume shadow copies, and searches local drives and network shares for files to encrypt.
  • Talos provides Snort signatures and a ClamAV detection for the threat.

Article Details

Attack Vectors
  • RA Group deploys ransomware that encrypts files on victims' local drives and remotely mapped network drives, appending the .GAGUP extension.
  • The ransomware deletes volume shadow copies using vssadmin.exe and clears the Recycle Bin.
  • RA Group uses double extortion: it exfiltrates victims' data, threatens to publish it on a leak site, and offers the data for download from a Tor site.
  • Customized ransom notes direct victims to contact the operators and include a link to download exfiltration proofs.
Defensive Notes
  • Cisco Talos recommends Cisco Secure Endpoint to prevent execution of the malware, Cisco Secure Web Appliance to block malicious websites, and Cisco Secure Email to block malicious emails.
  • Cisco Secure Firewall, Cisco Secure Malware Analytics, and Umbrella are also cited as protections for detecting or blocking activity associated with the threat.
  • Cisco Duo provides multi-factor authentication, and ClamAV detections are available for the threat.
  • Snort SIDs listed for the threat are 61761-61764 for Snort 2 and 300543-30054 for Snort 3.

MITRE ATT&CK

T1135 · Network Share DiscoveryThe ransomware enumerates network shares and available network resources before encrypting files on remotely mapped drives.T1486 · Data Encrypted for ImpactRA Group ransomware encrypts files on local and remotely mapped drives and appends the .GAGUP extension.T1490 · Inhibit System RecoveryThe ransomware deletes volume shadow copies using vssadmin.exe.

People

Chetan RaghuprasadNamed author of the article.

Threat Actors

RA GroupRansomware actor reported by Talos to have operated since at least April 22, 2023, and to have compromised organizations in the U.S. and South Korea.

Malware

Babukand South Korea with leaked Babuk source codeRA Group ransomwareSample of a ransom note.RA Group ransomware code appears highly customized

Vendors

CiscoCisco Talos recently discovered a new ransomware actor called RA Group that has been operating since at least April 22, 2023.

Products

Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ClamAVClamAV detections are available for this threat:qToxfiles and folders are necessary for the system to work properly and to allow the victims to download the qTox application and contact RA group operators using the qTox ID provided on the ransom note.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 61761-61764 for Snort 2 and 300543-30054 forUmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Tools

vssadmin.exethe API SHEmptyRecyclebinA. It deletes the volume shadow copy by executing the local Windows binary vssadmin.exe, an administrative tool used to manipulate shadow copies.

Countries

South Koreaand South Korea with leaked Babuk source codeUnited StatesNewly identified RA Group compromises companies in U.S.

Industries

Insuranceand one in South Korea across several business verticals, including manufacturing, wealth management, insurance providers and pharmaceuticals.Manufacturingthree organizations in the U.S. and one in South Korea across several business verticals, including manufacturing, wealth management, insurance providers and pharmaceuticals.Pharmaceuticalsseveral business verticals, including manufacturing, wealth management, insurance providers and pharmaceuticals.Wealth managementin the U.S. and one in South Korea across several business verticals, including manufacturing, wealth management, insurance providers and pharmaceuticals.

Related Articles