Home / Threat actors / RTM
RTM G0048
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
9
Techniques
1
Malware and tools
RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing Attachment Execution
T1204.002 Malicious FileT1574.001 DLL Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder Stealth
T1574.001 DLL Command and Control
T1102.001 Dead Drop ResolverT1219.002 Remote Desktop Software Malware and tools
- RTMMalwareS0148
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.