- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0048 · 7 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0152 · rtm
RussiaWhat it is
RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0048
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Czech, Germany, Kazakhstan, Russia, Ukraine
Tools
The tools and malware families the sources tie to it.
- AtNow
- Back Orifice
- Back Orifice 2000
- Backdoor.Oldrea
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- RTM
- Remote Utilities
- RemoteCMD
- RemotePC
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de