RTM

RTM is a malicious software, first reported as the RTM banking Trojan, that was initially detected by vendors such as Symantec and Microsoft in 2017. This malware operates on Windows 7 RTM (7600) and was later updated to a variant known as Redaman. The leaked source code of RTM has been utilized to create new ransomware variants including RTM Locker, Rook, and the self-propagating Rorschach ransomware. These variants have been particularly targeting ESXi servers. RTM Locker, discovered by Uptycs’ Threat Intelligence unit during dark web reconnaissance, encrypts victims' files, appending the ".RTM" extension to their names, and creates a ransom note threatening the publication of stolen data if a ransom isn't paid within 48 hours. Victims are instructed to contact RTM’s “support” via the anonymous messaging platform Tox to initiate negotiations for the ransom payment. However, the initial access vector for RTM Locker remains unknown according to security researchers. Decryption of files locked with RTM Locker appears unlikely due to the use of a combination of asymmetric and symmetric encryption which makes decryption impossible without the private key. Decrypting a file requires both the public key appended to the end of the encrypted file and the attacker's private key. Currently, there are no free decryptors for RTM Locker as the encryption process used is secure and hasn’t been cracked.