Thursday, December 7, 2023

Ramsay – A cyber‑espionage Toolkit Attack Steal Sensitive Document From Air‑Gapped Networks

Recently, the cybersecurity firm ESET has discovered a malware toolkit, which has been named as Ramsay, a rare malware attack with the advanced capabilities that are rare nowadays.

Ramsay is created with features to attack air-gapped computers, assemble Word and other delicate documents in a sealed storage container.

After that, the attacker simply waits for a possible opportunity to steal sensitive documents from the infected network.

Ramsay is critical because it’s one of the rarest malware attacks that has happened recently.

Thus ESET stated that this malware is mainly developed to space up the air gap and reach all the isolated networks. 

Ramsay Malware Attack vectors

Moreover, Ramsay has a total of three different versions with different functions.

The very first one was organized in September 2019 (Ramsay v1), and then the second one complies in early and late March 2020 (Ramsay v2.a and v2.b).

Malicious documents dropping Ramsay version 1

In this attack vector, the attacker uses the malicious documents exploiting CVE-2017-0199 through which they deliver a Visual Basic Script, “OfficeTemporary.sct.” This script then extracts within the document’s body, and then by having a base64-encoded PE under a JPG header, it pretends itself to be a typical JPG image to fool the victim.

Decoy installer dropping Ramsay version 2.a

Along with the debut of new features like Spreader component and a rootkit, this version of Ramsay, “Ramsay version 2.a,” clearly shows its deception and persistence tactics.

Malicious documents dropping Ramsay version 2.b

Just like the Ramsay version 1, in this attack vector also, the attacker uses the malicious documents but exploiting CVE-2017-11882. Through this exploit, the attackers drop “lmsch.exe,” a Ramsay Installer. In short, the Ramsay version 2.b is a slightly modified version of Ramsay version 2.a.

Well, all its versions are created along with the spreader module that added models of the Ramsay malware to each PE (portable executable) files that are found on portable drives and network shares.

Thus ESET said that they were so confused at first at it is quite rare and was challenging to identify it. 

Most importantly, this malware is operating to jump the air gap and reach isolated networks, as we said above.

In contrast, the users would most probably move the infected executables between the company’s various network layers and ultimately end up on a remote system.


Well, if we talk about the capabilities of Ramsay, then it is a very highly versatile mechanism. Thus, it implements several persistent methods like command execution, file collection, communication protocol, spreading, and many more. 

But Ramsay has many similarities with Retro, as both malware uses the same encoding algorithm, yet till now, it’s not clear that who is actually behind this malware attack.

Apart from this, the security researcher at ESET has also noticed Korean language metadata within the malicious documents.

Since the Ramsay malware is similar to Retro, that’s why the security researcher at ESET, Ignacio Sanmillan believes that it must also be operated with the interests of the South Korean government as the Retro malware strain was developed by the DarkHotel group, which was also performed with the attention of the South Korean government.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles