Raworld

Inactive

RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.

126 Victims

Apr 27, 2023 First Discovered

Dec 28, 2024 Last Discovered

672 Days Inactive

0% Infostealer

0/2 Sites Online

Known Locations (2)

RA World

raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion

RA World

pa32ymaeu62yo5th5mraikgw5fcvznnsiiwti42carjliarodltmqcqd.onion

Tools Used

CredentialTheft

ProcDump

DefenseEvasion

Bluetooth Stack for Windows by Toshiba (toshdpdb.exe)

LOLBAS

PsExec

Networking

NPS

Offsec

Impacket

Intelligence

📄 2 Ransom Notes
View the actual ransom notes used by this group →

Victims (126)

Detailed victim list temporarily unavailable

This group has 126 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.