From RA Group to RA World: Evolution of a Ransomware Group

This report details activity by RA World (formerly RA Group), an active ransomware group conducting multi-extortion operations with a Babuk-based final payload and a public leak site; it documents their multi-stage infection chain (loaders, service persistence, Babuk variant), observed TTPs (Impacket, PsExec/ProcDump, WMI lateral movement, NPS remote access), primary impacted sectors (manufacturing and healthcare), geographic distribution (predominantly U.S., Europe, and Southeast Asia), and provides IOC hashes and recommended mitigations using Palo Alto Networks products.