RTM

Executive Summary

RTM, also known as G0048, is a cybercriminal group that has been active since at least 2015, primarily targeting users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name to compromise victim systems. RTM's motivations and goals are not fully understood, but their actions suggest a financial motivation.

Goals & Targeting

RTM's strategic objectives and targeting profile suggest a focus on financial gain, potentially through the theft of sensitive financial information or the disruption of financial services. The group's targeting of remote banking systems in Russia and neighboring countries implies a regional focus, possibly due to the group's geographical location or linguistic expertise. Typical victims of RTM's attacks are likely to be financial institutions, organizations operating in the financial sector, or individuals with access to sensitive financial information.

Despite the available information, there are still gaps in our understanding of RTM's operations and motivations. Further research and analysis are needed to fully comprehend the group's goals, targeting profile, and potential connections to other threat actors. Nevertheless, the available data suggests that RTM is a significant threat to organizations operating in the financial sector, particularly those with a presence in Russia and neighboring countries.

Key Capabilities

• Trojan development and deployment
• Spear-phishing and social engineering
• Drive-by compromise and exploitation
• DLL and registry manipulation
• Remote desktop software exploitation

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RTM's campaign patterns and operational tempo are not well understood, but their use of tailored Trojans and spear-phishing attacks suggests a level of planning and coordination. The group's targeting of remote banking systems in Russia and neighboring countries implies a regional focus, possibly due to the group's geographical location or linguistic expertise. Notable past operations include the reported attacks on financial institutions in Russia and neighboring countries, which suggest a level of success in the group's campaigns.

IOC Patterns

• Spear-phishing with malicious attachments
• Drive-by compromise via exploited vulnerabilities
• DLL and registry manipulation for persistence
• Remote desktop software exploitation for lateral movement

Recommended Actions

• Implement robust email security controls to detect and block spear-phishing attacks
• Regularly update and patch software vulnerabilities to prevent drive-by compromise
• Monitor system logs for suspicious activity, particularly related to DLL and registry manipulation
• Implement robust privileged access management controls to prevent lateral movement

Suggested Tags