RA World

RA World is a ransomware group. In the provided reporting, it is identified as one of the ransomware groups targeting Korean companies, with activity noted in 2023 as part of a broader increase in ransomware attacks against South Korean organizations. The content also notes suspected links between some ransomware operations and Chinese cyber-espionage activity, specifically citing RA World for using PlugX; this is presented as a suspected linkage, not a confirmed attribution. Reported tooling associated with RA World in the provided content includes PlugX and Impacket. The content also references exploitation of PAN-OS vulnerability CVE-2024-0012 in the context of ransomware operations suspected to be linked to Chinese cyber-espionage groups, including RA World. No additional confirmed aliases or sub-groups are provided beyond RA World.