Ransomware Group “RA World” Changes Its’ Name and Begins Targeting Countries Around the Globe

RA World (formerly RA Group) ransomware has evolved from region-specific attacks to industry-focused campaigns targeting Healthcare and Finance across multiple regions (US, South Korea, EU, Latin America, Asia). TrendMicro's analysis highlights multistage malware with anti-AV tactics, initial access via phishing or weak credentials, and a novel extortion technique of publicly listing non-paying victims to coerce payments.