ESET researchers have discovered a previously unreported cyber espionage framework they dub Ramsay. The framework is tailored for collecting and exfiltrating sensitive documents from air-gapped systems that are not connected to the internet or other online systems. Since the number of victims so far is very low, ESET believes that this framework is under an ongoing development process.<\/p>\n\n\n\n
\u201cWe initially found an instance of Ramsay in a VirusTotal sample uploaded from Japan that led us to the discovery of further components and other versions of the framework along with substantial evidence to conclude that the framework is still in a developmental stage, with delivery vectors subject to fine testing,\u201d says Alexis Dorais-Joncas, head of ESET\u2019s Montreal-based research team.<\/p>\n\n\n\n
According to ESET findings, Ramsay has gone through several iterations based on the different instances of the framework found, denoting a linear progression on the number and complexity of its capabilities. The developers in charge of infection vectors seem to be trying different approaches, such as using old exploits for Microsoft Word vulnerabilities from 2017 and deploying trojanized applications for delivery, potentially via spear-phishing. The three discovered versions of Ramsay differ in complexity and sophistication, with the latest third version being the most advanced, especially with regard to evasion and persistence.<\/p>\n\n\n\n
Ramsay\u2019s <\/em>architecture provides a series of capabilities managed via a logging mechanism:<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.eset.ee\/wp-content\/uploads\/2020\/05\/graph-1-1024x652.png\")
<\/figure>\n\n\n\n