RTM
RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--c416b28c-103b-4df1-909e-78089a7e0e5f
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T00:42:30+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (7)
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. De
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Software & Tools (1)
RTM is custom malware written in Delphi. It is used by the group of the same name ([RTM](https://attack.mit
Explore this actor's full graph with Ninja Signal