Ramnit

Ramnit is a long-running Windows malware family that originated around 2010 as a worm and file infector before evolving into a banking trojan with Zeus-derived functionality. It has been used to spy on infected users, steal banking and other credentials, inject malicious content into web sessions, harvest cookies, and download additional malware. Ramnit has also functioned as a loader for secondary payloads, including ransomware and proxy malware such as Ngioweb, and has been observed in broader criminal delivery ecosystems alongside loaders and downloaders such as sLoad and SnatchLoader.

Ramnit is notable for combining multiple capabilities in one family. Reported behaviors include credential theft, web injects against financial and payment-related sites, cookie theft, browser-focused hooking, hidden VNC-related functionality in the broader banking-malware ecosystem, custom command-and-control communications, and modular payload delivery. Some variants used a Domain Generation Algorithm for command-and-control discovery, while others relied on hardcoded infrastructure. Historical samples also exhibited file-infection behavior by appending malicious code to executable and HTML files, and some analyses described rootkit-like components, process injection, persistence mechanisms, and interference with security tooling.

Distribution has occurred through several common crimeware channels over time, including exploit kits, drive-by download campaigns, spam and malspam operations, and delivery by other malware families or loaders. Ramnit has been associated with campaigns using the RIG and Blackhole exploit kits, geographically filtered drive-by chains, and email-delivered downloader activity. It has also appeared as a follow-on payload in post-compromise activity and in malware service ecosystems linked to financially motivated actors.

Ramnit is primarily associated with financial cybercrime and online banking fraud, but its use has expanded beyond direct banking theft. It has targeted Windows users across multiple regions, with localized web-inject configurations and country-specific payloading observed in some campaigns. The family survived major disruption efforts, including a 2015 takedown, and remained active in later years. Reporting has also noted code or ecosystem relationships involving Bumblebee, Trickbot, and Conti-linked developers, although such links do not by themselves establish unified operations. Overall, Ramnit remains best characterized as a mature, adaptable Windows banking malware family with loader, theft, and post-compromise utility.