Wednesday, April 24, 2024

Ramsay – A cyber‑espionage Toolkit Attack Steal Sensitive Document From Air‑Gapped Networks

Recently, the cybersecurity firm ESET has discovered a malware toolkit, which has been named as Ramsay, a rare malware attack with the advanced capabilities that are rare nowadays.

Ramsay is created with features to attack air-gapped computers, assemble Word and other delicate documents in a sealed storage container.

After that, the attacker simply waits for a possible opportunity to steal sensitive documents from the infected network.

Ramsay is critical because it’s one of the rarest malware attacks that has happened recently.

Thus ESET stated that this malware is mainly developed to space up the air gap and reach all the isolated networks. 

Ramsay Malware Attack vectors

Moreover, Ramsay has a total of three different versions with different functions.

The very first one was organized in September 2019 (Ramsay v1), and then the second one complies in early and late March 2020 (Ramsay v2.a and v2.b).

Malicious documents dropping Ramsay version 1

In this attack vector, the attacker uses the malicious documents exploiting CVE-2017-0199 through which they deliver a Visual Basic Script, “OfficeTemporary.sct.” This script then extracts within the document’s body, and then by having a base64-encoded PE under a JPG header, it pretends itself to be a typical JPG image to fool the victim.

Decoy installer dropping Ramsay version 2.a

Along with the debut of new features like Spreader component and a rootkit, this version of Ramsay, “Ramsay version 2.a,” clearly shows its deception and persistence tactics.

Malicious documents dropping Ramsay version 2.b

Just like the Ramsay version 1, in this attack vector also, the attacker uses the malicious documents but exploiting CVE-2017-11882. Through this exploit, the attackers drop “lmsch.exe,” a Ramsay Installer. In short, the Ramsay version 2.b is a slightly modified version of Ramsay version 2.a.

Well, all its versions are created along with the spreader module that added models of the Ramsay malware to each PE (portable executable) files that are found on portable drives and network shares.

Thus ESET said that they were so confused at first at it is quite rare and was challenging to identify it. 

Most importantly, this malware is operating to jump the air gap and reach isolated networks, as we said above.

In contrast, the users would most probably move the infected executables between the company’s various network layers and ultimately end up on a remote system.


Well, if we talk about the capabilities of Ramsay, then it is a very highly versatile mechanism. Thus, it implements several persistent methods like command execution, file collection, communication protocol, spreading, and many more. 

But Ramsay has many similarities with Retro, as both malware uses the same encoding algorithm, yet till now, it’s not clear that who is actually behind this malware attack.

Apart from this, the security researcher at ESET has also noticed Korean language metadata within the malicious documents.

Since the Ramsay malware is similar to Retro, that’s why the security researcher at ESET, Ignacio Sanmillan believes that it must also be operated with the interests of the South Korean government as the Retro malware strain was developed by the DarkHotel group, which was also performed with the attention of the South Korean government.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Phishing Attacks Rise By 58% As The Attackers Leverage AI Tools

AI-powered generative tools have supercharged phishing threats, so even newbie attackers can effortlessly create...

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely

The widely used MySQL2 has been discovered to have three critical vulnerabilities: remote Code...

CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany,...

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles