RA World Ransomware Uses Lengthy Ransom Note

During a routine examination of new file submissions, our team uncovered the RA World ransomware. This type of malicious software functions by encrypting files, compelling victims to make payments for their decryption.

In our testing environment, RA World executed file encryption and appended a ".RAWLD" extension to the filenames. Consequently, a file originally named "1.jpg" transformed into "1.jpg.RAWLD," and "2.png" became "2.png.RAWLD," and so forth. Upon completion of the encryption process, a ransom message titled "Data breach warning.txt" was generated. The contents of this message indicate that RA World utilizes a strategy known as double extortion.

The ransom note from RA World informs the victim that their files have been both encrypted and stolen, listing the types of exfiltrated data. To decrypt the files and ensure the removal of downloaded files from the attackers' servers, a payment must be made. Failure to comply with the ransom demand may result in the cybercriminals publishing the stolen content and notifying interested parties of the security breach.

If communication with the attackers is not established within three days, some files will be made public. After seven days, data will be leaked in batches, and news of the compromise will be disseminated. Furthermore, any delay in contact will lead to an escalation in the ransom amount.

RA World Ransom Note in Full

The complete text of the RA World ransom note reads as follows:

RA World

Notification
Your data are stolen and encrypted when you read this letter.
We have copied all data to our server.
Don't worry, your data will not be compromised if you do what I want.
But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again.

What we do?
We stole all laboratory reports from your servers.
We stole all important files from your file server.
We stole some important databases from your sql server.
We encrypt all your files.

What we want?
Contact us, pay for ransom.
If you pay, we will provide you the programs for decryption and we will delete your data.
If not, we will leak your datas and your company will appear in the list below.
If not, we will email to your customers and report to supervisory authority.

How contact us?
We use qTox and Telegram to contact, you can get more information from qTox office website:
hxxps://qtox.github.io

Our qTox ID is:
(alphanumeric string)

Telegram Account:
@Connect_202308
Link:hxxps://t.me/Connect_202308

We have no other contact.
If there is no contact within 3 days, we will make sample files public.
If there is no contact within 7 days, we will stop communicating and release data in batches.
The longer time, the higher ransom.

RA World Office Site:
[Permanent address] -
[Temporary address] -

Information release link:
Sample files:

Unpay Victim List
You'll be here too if you don't pay!

Their files can be downloaded from our site:
[Permanent address] -
[Temporary address] -

You can use Tor Browser to open .onion url.
Ger more information from Tor office website:
hxxps://www.torproject.org

How Can You Protect Your Data from Ransomware?

Protecting your data from ransomware requires a combination of preventive measures, user education, and proactive security practices. Here are some effective strategies to safeguard your data from ransomware attacks:

Backup Regularly:
Regularly back up your important data and store backups offline or in a secure cloud environment. This ensures that even if your primary data is compromised, you can restore it from a clean backup.

Update Software and Systems:
Keep your operating system, antivirus software, and applications up to date. Regularly applying security patches helps protect against known vulnerabilities that ransomware may exploit.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software to detect and block ransomware threats. Ensure that the software is regularly updated to defend against new threats.

Enable Email Filtering:
Use email filtering solutions to block malicious attachments and links. Many ransomware attacks start with phishing emails, so filtering out these threats at the email gateway can be an effective defense.