Rounding Up the DNS Traces of RA World Ransomware

Threat actors typically come in two types. They are either cybercriminals who are in it for profit or advanced persistent threat (APT) group members in it for ideology.

There are times, though, when actors get involved in both attack types. Case in point? Researchers recently reported that a threat actor who has been involved in installing backdoors in the systems of target government institutions instigated an RA World ransomware attack.¹ The actor used the same tools as those involved in China-linked espionage campaigns.

The report identified five indicators of compromise (IoCs) that WhoisXML API expanded. We uncovered other connected artifacts, namely:

• 11 email-connected domains
• Two additional IP addresses
• Four IP-connected domains, one of which turned out to be malicious
• 12 string-connected domains
• 194 string-connected subdomains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.security.com/threat-intelligence/chinese-espionage-ransomware