Skip to content

RTM

RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).

ATT&CK ID: G0048
Techniques: 7
Tools: 1

Techniques

Initial Access

Drive-by Compromise Phishing

Execution

User Execution Hijack Execution Flow

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Stealth

Hijack Execution Flow

Command and Control

Web Service Remote Access Tools

Software

RTM

MITRE ATT&CK All threat actors