Security researchers have uncovered a new ransomware family whose attacks include source code of the Babuk ransomware. Many groups have emerged since the leak of the Babuk code in September 2021, including the Rook, Night Sky, Pandora, AstraLocker 2.0, ESXiArgs, Rorschach, RTM Locker, and RA ransomware groups. Specific to the RA Group, these threat actors have been operating for just over a month and have set their sights on targeting insurance, manufacturing, wealth management, and pharmaceutical industries throughout the United States and South Korea. The RA group also integrates a double extortion tactic into their attacks by first ransoming the victim, then posting their exfiltrated data if payment is not met swiftly. As of May 16, 2023, there are four (4) total victims listed on their public leak site, including an organization from each of the targeted industries above. Analysis of RA Group’s ransomware code shows high customization variant of the Babuk ransomware payload, including a rapid encryption process and detection evasion. Furthermore, the ransomware payload attempts to remove any breadcrumbs by deleting specific files, emptying the Recycle Bin, and removing volume shadow copies. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.