Ramsay
MITRE ATT&CK: S0458 View on attack.mitre.org
Aliases: Ramsay
- First seen
- 2020-04-15 00:00:00
- Malware type
- spyware, trojan
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 231 (231 malicious)
- Last IoC activity
- 2026-10-17 21:23:57
- Profile updated
- 2026-07-07 12:35:39
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.
Recent IoC activity
231 malicious indicators in Maltiverse are attributed to Ramsay (S0458). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 616 Sigma rules
Malware & tools used
- Network Share Discovery (attack-pattern)
- Dynamic Data Exchange (attack-pattern)
- Screen Capture (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Native API (attack-pattern)
- Rootkit (attack-pattern)
- Network Service Discovery (attack-pattern)
- Web Protocols (attack-pattern)
- Taint Shared Content (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- Data from Local System (attack-pattern)
- Scheduled Task (attack-pattern)
- Local Data Staging (attack-pattern)
- Peripheral Device Discovery (attack-pattern)
- DLL (attack-pattern)
- Data from Network Shared Drive (attack-pattern)
- Archive via Custom Method (attack-pattern)
- Archive via Utility (attack-pattern)
- Exploitation for Client Execution (attack-pattern)
- Local Storage Discovery (attack-pattern)
- Steganography (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- Process Discovery (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Bypass User Account Control (attack-pattern)
Detection rules
- MALPEDIA_Win_Ramsay_Auto (yara-rule)
Reports & references
- antiy.cn — 20200522 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ramsay (report)
- youtube.com — Watch (report)
- ESET — Ramsay Cyberespionage Toolkit Airgapped Networks (report)
- sentinelone.com — Why On Device Detection Matters New Ramsay Trojan Targets Air Gapped Networks (report)
- MITRE ATT&CK — S0458 (report)
- programmersought.com — 62493896999 (report)
- ESET — Eset Jumping The Air Gap Wp (report)
- blog.bushidotoken.net — Deep Dive Darkhotel Apt (report)
- cocomelonc.github.io — Malware Pers 5 (report)