Dark Web Profile: RA World

RA World is a ransomware operation, likely a rebranded iteration of RA Group, observed since May 2023 using a modified Babuk encryptor (Curve25519 for key exchange and HC-128 for file encryption) that produces extensions such as .GAGUP and .RAWLD; the group steals victims' data and applies staged leak extortion with deadlines to pressure victims. Targets span Western countries (notably the US, Germany, UK) and parts of the Indo-Pacific, with healthcare, finance, and supply-chain sectors frequently impacted; the report also outlines mitigation best practices.