MITRE ATT&CKgroup

G0048 RTM

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2017-05-31

Description

RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).

Related

Uses · MITRE ATT&CK (8)

  • T1219.002 Remote Desktop Software sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1189 Drive-by Compromise technique
  • S0148 RTM software (malware)

References