0attributed CVEs
13ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active
About this actor
[RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://attack.mitre.org/software/S0148)). (Citation: ESET RTM Feb 2017)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
G0048
Unclassifiedno scheme matched
RTM
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 13 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1102Web Service ↗T1102.001Dead Drop Resolver ↗T1189Drive-by Compromise ↗T1204User Execution ↗T1204.002Malicious File ↗T1219Remote Access Tools ↗T1219.002Remote Desktop Software ↗T1547Boot or Logon Autostart Execution ↗T1547.001Registry Run Keys / Startup Folder ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
CM-2 | 10 / 13 | 77% |
CM-6 | 10 / 13 | 77% |
SI-3 | 10 / 13 | 77% |
SI-4 | 10 / 13 | 77% |
AC-4 | 9 / 13 | 69% |
CA-7 | 9 / 13 | 69% |
SC-7 | 8 / 13 | 62% |
CM-7 | 7 / 13 | 54% |
SI-2 | 6 / 13 | 46% |
SI-7 | 6 / 13 | 46% |
SI-10 | 5 / 13 | 38% |
SC-44 | 4 / 13 | 31% |
SI-8 | 4 / 13 | 31% |
RA-5 | 3 / 13 | 23% |
AC-3 | 2 / 13 | 15% |
Co-occurring actors
None.