{
  "family": "ramnit",
  "sample_count": 20595,
  "category": "worm_banker",
  "description": "Ramnit is a worm that steals information from compromised systems. Per Malwarebytes, it downloads component files for specific tasks: one component steals cookies to hijack banking and social-media sessions, while another gives attackers remote access. It arrives via removable and fixed drives, public FTP servers, exploit kits, or bundling with potentially unwanted software. Originally a worm that evolved toward banking fraud and botnet activity, its infrastructure was targeted in law-enforcement action in 2015.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ramnit"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ramnit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A worm that steals information from infected systems, including banking and social-media session data, and can grant attackers remote access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ramnit steal banking information?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "One of its downloadable components steals cookies, which can be used to hijack banking and social-media sessions."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ramnit spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via removable and fixed drives, public FTP servers, exploit kits, and bundling with potentially unwanted software."
      }
    },
    {
      "@type": "Question",
      "name": "Can Ramnit give attackers remote control?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes; one of its components is capable of providing threat actors remote access to the affected system."
      }
    },
    {
      "@type": "Question",
      "name": "Was Ramnit ever disrupted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its botnet infrastructure was targeted in a 2015 law-enforcement operation, though the family continued to be observed afterward."
      }
    },
    {
      "@type": "Question",
      "name": "How can I reduce the risk from Ramnit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disable autorun on removable drives, be cautious with bundled/unwanted software and downloads, keep systems patched, and use reputable security software."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read an authoritative source on Ramnit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malwarebytes maintains a Worm.Ramnit detection page, linked on this page."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1091",
    "T1547.001",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "Malwarebytes: Worm.Ramnit",
      "url": "https://www.malwarebytes.com/blog/detections/worm-ramnit"
    }
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}