Ramsay, also referred to as Ramsay Malware, is a cyber espionage framework and toolkit that was discovered by ESET Research in 2020.[1]
Ramsay is specifically tailored for Windows systems on networks that are not connected to the internet and that also isolated from intranets of companies, so called air-gapped networks, from which it steals sensitive documents like Word documents after first collecting them in a hidden storage folder.[2][3]
ESET researchers found various versions of the malware, and believe that in May 2020 it was still under development. They numbered the versions Ramsay Version 1, Ramsay Version 2a and Ramsay Version 2b. The very first encounter with the malware was a sample that was uploaded from Japan to VirusTotal. The first version was compiled in September 2019. The last version that they found was most advanced.[1]
The discovery of Ramsay was seen as significant as malware is rarely able to target physically isolated devices.[4]
Authorship
editWhile authorship has not been attributed, it has many common artefacts with Retro, a backdoor by hacking entity Darkhotel believed to operate in the interests of South Korea.[5]
Workings of the malware
editThe three versions of Ramsay that ESET found have different workings.
Ramsay version 1 does not include a rootkit, whilst the later versions do.
Ramsay version 1 and 2.b exploit CVE-2017-0199, a "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."[6]
Version 2.b also uses exploit CVE-2017-11882 as an attack vector.[2]
The way in which Ramsay can spread is via removable media like USB sticks and network shares. In this way, the malware can jump the air gap.[3]
References
edit- ^ a b "New cyber espionage framework named Ramsay discovered by ESET Research | ESET". May 16, 2020. Archived from the original on 2020-05-16.
- ^ a b "Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks | WeLiveSecurity". May 14, 2020. Archived from the original on 2020-05-14.
- ^ a b "New Ramsay malware can steal sensitive documents from air-gapped networks". ZDNet. May 13, 2020. Archived from the original on 2020-05-13.
- ^ "ESET found Ramsay malware targeting systems isolated by an air gap". May 20, 2020. Archived from the original on 2020-05-20.
- ^ Cimpanu, Catalin. "New Ramsay malware can steal sensitive documents from air-gapped networks". ZDNet.
- ^ "CVE-2017-0199 Detail". nvd.nist.gov. Archived from the original on 2022-07-29.