RMSMalware
- gussdoor
- Remote Manipulator System
- rurat
CyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1053.005Scheduled Task
“…dule builds a PowerShell command that loads the stager module from the registry and executes it, the installer module then creates a scheduled task to run the PowerShell command.”
- T1014Rootkit
“Elastic Security Labs steps through the r77 rootkit”
- T1027.006HTML Smuggling
“Next, it initiates a HTML Smuggling technique with a Base64-encoded RAR archive embedded in its source code, named 2_14_6_1033_09.12.2025.rar and exploiting CVE-2025-8088.”
- T1036Masquerading
“To maintain a resilient connection with C2 server, GammaWorm establishes a persistence mechanism masquerading as a system maintenance tool.”
- T1055.012Process Hollowing
“This is accomplished using a process hollowing technique into a newly spawned process under another legitimate process through PPID spoofing.”
- T1134.004Parent PID Spoofing
“Parent PID spoofing”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“…d on a multi-stage execution chain, often using up to three nested stages, to download and execute off-the-shelf payloads like Remote Manipulator System (RMS) RAT, a tool widely shared on Russian hacker forums, or UltraVNC, an open-source remote access utility.”
-
Elastic Security Labs steps through the r77 rootkit“The script also downloaded and set up the Remote Manipulator System (RMS) tool, a closed source program for remote administration, developed by the Russian company TektonIT, which could be used to remotely control the infected machine and issue commands from a remote location.”
Indicators in its reports
named in the reports above- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- 1794369214b7f62e70a0485e61335c61in 1 report
- hxxp://iiwdsxwamylbwwsoyrmj.supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025in 1 report
- hxxps://[email redacted][.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdfin 1 report
- 8e1624d110c090ff57d4b493a9107c66in 1 report
- hxxps://graph[.]org/in 1 report
- graph[.]orgin 1 report
- 104.194.140[.]6in 1 report
- moment-cat-qld-place.trycloudflare[.]comin 1 report
- shellobject[.]runin 1 report
- hxxps://www.telegram[.]me/s/oberfaririn 1 report
- gov[.]tkin 1 report
- gov[.]skin 1 report
- net[.]uain 1 report
- mfa.gov[.]uain 1 report
- gov[.]trin 1 report
- hxxps://efficiency-planes-emotions-fascinating.trycloudflare[.]com/@myrain/Xh1Lta2Ccro?84wtj9ob-01-31in 1 report
- efficiency-planes-emotions-fascinating.trycloudflare[.]comin 1 report
- hxxps://efficiency-planes-emotions-fascinating.trycloudflare[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.