The RTM cybercrime group began its activity in 2015 and it attacks organizations from various sectors, to steal cash from accounts, confidential documents and accounts. The group uses malware that it develops itself. The group's malware does not have a static control server; it receives it through the blockchain.

• RTM downloader
• RTM backdoor
• Pony stealer
• Azorult stealer

• The finance sector
• The energy sector
• The state sector
• Information technologies
• Industrial sector

• Russia
• Belarus
• Kazakhstan

• Cash theft
• Confidential data
• Account theft

None

• https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf
• https://habr.com/ru/company/pt/blog/460857/
• https://broadcast.comdi.com/watch/r0uikvnq
• https://www.group-ib.com/blog/rtm