Research for this post was facilitated by Ziv Eli.

IBM X-Force researchers recently reported that the Ramnit Trojan has relaunched, targeting six major banks in the U.K.

After a silent period of about eight months, researchers observed that Ramnit’s operators set up two new live attack servers and a new command-and-control (C&C) server. They launched an infection campaign in the U.K. and are spreading new Trojan configurations to equip the malware with webinjections designed to target personal banking users.

Ramnit Returns

Internally, the Ramnit payload does not appear to have changed in any significant way; its operation, architecture and encryption algorithms remained the same. Some parts were updated, such as the “Hooker” module, which saw some renovation and was renamed “Grabber.” Also known as a Spy Module, this module is designed to hook the browser, monitoring URL access, enabling data theft in real time and displaying webinjections to the victims.

Ramnit’s DriveScan module remained unchanged. This component enables the Trojan to scan the drive for files with interesting keywords, such as “wallet,” “passwords,” and the names of banks targeted in the configurations. Ramnit’s operators gather that extra information to ensure they don’t miss out on any financial details or credentials victims may be keeping on their endpoints.

Although Ramnit originally features a virtual network computing (VNC) module, it does not seem to deploy it immediately. Nonetheless, a VNC module can be dynamically fetched from the malware’s control server at the attacker’s discretion and launched for use at any point.

The configuration side is where we can see that Ramnit has been preparing for the next phase, with new attack schemes built for real-time fraud attacks targeting online banking sessions. Not all attacks have to happen in real time or from the victim’s device; Ramnit’s operators can also gather credentials from infected users and use them to commit account takeover fraud from other devices at a later time.

Humble Beginnings

Ramnit is an evolving, persistent banking Trojan that emerged in 2010 in the more simplistic form of a self-replicating worm. As the malware project evolved, Ramnit’s developers chose to morph it into a banking Trojan and, in 2011, Ramnit donned on-the-fly data theft modules alongside webinjection capabilities borrowed from the Zeus Trojan’s exposed source code. It has been an active banking Trojan ever since, with remote control capabilities and extensive target lists that even included mule recruitment in the past.

According to X-Force Research, this malware saw its most prolific bank fraud phase in 2014, when it was named the fourth most active financial Trojan in the world behind Dyre, Neverquest and Dridex.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust

Ramn the Torpedoes

Ramnit’s activity came to halt in early 2015, when a Europol operation attempted to dismantle the project by taking down botnets operated by Ramnit’s masters. Unfortunately, Ramnit did not completely die. A few days after the takedown, some parts of the Ramnit botnet were still alive. The takedown attempt must have alerted Ramnit’s operators to the possibility that they could be captured by law enforcement, however, and activity subsequently died down for a while.

In December 2015, IBM X-Force reported renewed Ramnit activity that targeted banks and e-commerce in Canada, Australia, the U.S. and Finland. Since then, however, Ramnit servers have been silent — until now. As of July 2016, Ramnit has been preparing new attack schemes, testing, setting up an infection campaign and reconnecting the wires to mount two new attack servers.

According to X-Force threat intelligence, Ramnit appears to be operated by a private, closed cybergang. Ramnit’s source code has not been openly sold or shared with other cybercriminals, and we’ve observed no underground chatter. From what we’ve learned so far, there was no change in Ramnit’s status in that sense. It is possible that a new gang has picked the project up, but attribution remains vague.

Expanding List of Targets

Ramnit’s current targets appear to be limited to six major U.K. banks, but X-Force researchers expect the list to expand in the coming days or weeks. The malware’s operators are spreading more than one configuration out to new infected bots, with sophisticated social engineering injections and in-session fraud automation all wrapped into the same attack scheme.

Ramnit’s infection vectors in the past included malvertising and malware-laden spam. Ramnit’s operators have already used popular exploit kits, such as the Angler EK. We expect to see them reach out for the same methods in this new activity phase.

Malware IOCs

Sample MD5

  • 0784e53b2f19069ae4101440c93fb311
  • 81e5ab7fcc22193c88be5581f7062a27

U.K.-Targeting Configuration MD5

  • eb939f38861e6bbae800bbf422f66916

Antivirus engines can take a while to detect Ramnit, and in many cases do not detect it at all. Some of the aliases by top AV engines for this variant are:

  • Win32.Ramnit
  • Win32.Nimnul.a

Preventative Measures

The Ramnit banking Trojan is an evolving threat. It is designed to manipulate online banking sessions to steal user credentials and perform money transfer fraud attacks. To help stop Ramnit, banks and service providers can use adaptive malware detection solutions and protect customer endpoints with malware intelligence that provides real-time insight into fraudster techniques and capabilities.

Most cases of malware infections, including Ramnit, begin with a malware-laden spam email that lures victims into opening an attachment by indicating it is an invoice or another important document. If users are not expecting this document, their best bet is to delete the email immediately and then directly check their accounts or contact their service provider to look into the matter.

Those who frequently bank away from home are advised to never access any of their personal accounts from public computers. Online banking should be carried out from trusted devices that are protected by security solutions.

More from Advanced Threats

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today