Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks

guest · May 13, 2020

Researcher Spots New Malware Claimed to be 'Tailored for Air‑Gapped Networks'
May 13, 2020
https://thehackernews.com/2020/05/airgap-network-malware.html?utm_source=feedburner

A cybersecurity researcher at ESET today published an analysis of a new piece of malware, a sample of which they spotted on the Virustotal malware scanning engine and believe the hacker behind it is likely interested in some high-value computers protected behind air‑gapped networks.

Dubbed 'Ramsay,' the malware is still under development with two more variants (v2.a and v2.b) spotted in the wild and doesn't yet appear to be a complex attacking framework based upon the details researcher shared.
However, before reading anything further, it's important to note that the malware itself doesn't leverage any extraordinary or advanced technique that could let attackers jump air-gapped networks to infiltrate or exfiltrate data from the targeted computers.
Click to expand...

According to the researcher, the Ramsay samples they found do not have a network-based C&C communication protocol, nor does any attempt to connect to a remote host for communication purposes.

Honestly, there's no clear answer to this at this moment, but researcher speculate that the malware might have been 'tailored for air‑gapped networks' with similar scenarios—considering that the only option left is to physically access the machine and steal the collected data with a weaponized USB.

'It is important to notice that there is a correlation between the target drives Ramsay scans for propagation and control document retrieval,' the ESET researcher said.
Click to expand...

Moreover, since the malware is still under development, it's too early to decide if the malware has only been designed to target air-gapped networks.
We have reached out to ESET researcher for more clarity on the 'air-gap' claim and will update this story once he responds.
Click to expand...

ESET: Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks

ESET researchers uncover several instances of malware that uses various attack vectors to target systems isolated by an air gap
Click to expand...

guest · May 14, 2020

mood said: ↑

Researcher Spots New Malware Claimed to be 'Tailored for Air‑Gapped Networks' May 13, 2020
Click to expand...

Updated:

UPDATE: Researcher Explains 'Air Gap' Scenarios
Researcher Ignacio Sanmillan, who discovered and analyzed Ramsay malware, has provided the following explanation for our readers.

"We only have a copy of the Ramsay agent, which only has code to aggregate and compress the stolen data in a very decentralized and covert way on the local filesystem of the infected host. Based on this, we assume that another component is responsible for scanning the filesystem, locating the compressed files, and performing the actual exfiltration."
On asking if the attacker needs to rely on the physical access for data exfiltration, Sanmillan said:

"There are several ways the attacker might do this. We have not seen this operation performed; however, we have a few hypotheses on how the attacker could do this. Those are only our best-educated guess and pure speculation at this point, so please treat those two hypothetical scenarios as such." [...]
Click to expand...

Log in or Sign up

Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks

guest Guest

guest Guest

Log in or Sign up

Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks

guest Guest

guest Guest

Useful Searches