The Ramsay “framework” emerged in late 2019. As of April 2020, there appear to be two fully maintained branches of the framework. The Ramsay malware/toolsets are heavily focused on both persistence and data exfiltration from air-gapped environments.
The original version of Ramsay was distributed via maliciously-crafted office documents. These documents were distributed via email, and were designed to exploit CVE-2017-0199 to facilitate the installation of the malware. CVE-2017-0199 is a remote code execution flaw in Microsoft Word. Specifically, it allows attackers to retrieve and launch code, including VBS & PowerShell upon launching of a specially-crafted RTF document.
Later versions of Ramsay (aka v2.a / 2.b) were distributed as trojanized installers for well-known applications (ex: 7zip). These later versions also included an aggressive spreading mechanism, which locates PE files (local and network adjacent) and infects them to allow for further spreading in targeted environments.
Along with the spreading capabilities, Ramsay includes multiple techniques for maintaining persistence. These include:
DLL Hijacking
AppInitDLL Registry Key Entries
Scheduled Tasks
