• Cisco Talos recently discovered a new ransomware actor called RA Group that has been operating since at least April 22, 2023.


• The actor is swiftly expanding its operations. To date, the group has compromised three organizations in the U.S. and one in South Korea across several business verticals, including manufacturing, wealth management, insurance providers and pharmaceuticals.


• Talos assesses with high confidence that RA Group is leveraging leaked Babuk ransomware source code.

Who is the RA Group?

Talos recently discovered a …

actor april babuk called cisco cisco talos code companies compromised korea leaked operations organizations ra group ransomware source code south south korea talos