Ramnit

Ramnit is a banking trojan and file-infector malware family associated with banking fraud, credential theft, and follow-on malware delivery. The content describes Ramnit as targeting the banking sector and notes capabilities including information exfiltration, screenshot capture, and file execution. It is also referenced as a common information stealer and as malware that has used HVNC functionality for banking fraud. Multiple delivery chains are mentioned: sLoad is described as a PowerShell-based downloader primarily used to deliver the Ramnit banking trojan, including in a phishing campaign targeting users in Ukraine that used malicious RAR/ZIP archives and a disguised PDF LNK shortcut to launch PowerShell and stage additional payloads from Bitbucket and GitHub infrastructure. Ramnit was also observed being delivered by Bedep in malvertising-driven Angler exploit kit activity, and by AdGholas/Stegano exploit kit campaigns in which downloader/Kryptik samples either contained or downloaded Ramnit. The content further notes that, like Trickbot, Zloader, and Dridex, Ramnit operators were observed shifting away from pure banking fraud toward loader-style use for second-stage attacks, often ransomware. Sekoia.io also reported a significant increase in tracked Ramnit servers in 2023.