Rounding Up the DNS Traces of RA World Ransomware
Threat actors typically come in two types. They are either cybercriminals who are in it for profit or advanced persistent threat (APT) group members in it for ideology.
There are times, though, when actors get involved in both attack types. Case in point? Researchers recently reported that a threat actor who has been involved in installing backdoors in the systems of target government institutions instigated an RA World ransomware attack.1 The actor used the same tools as those involved in China-linked espionage campaigns.
The report identified five indicators of compromise (IoCs) that WhoisXML API expanded. We uncovered other connected artifacts, namely:
- 11 email-connected domains
- Two additional IP addresses
- Four IP-connected domains, one of which turned out to be malicious
- 12 string-connected domains
- 194 string-connected subdomains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.security.com/threat-intelligence/chinese-espionage-ransomware
Latest Reports
Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
WhoisXML API uncovered 7,100+ additional artifacts linked to the Integrity Tech-enabled global data theft attack. Download the threat research materials now.
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.