RTM
RTM is a Russia-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance, and Transportation and Logistics sectors in 6 countries, including Germany and Russia. It uses 22 MITRE ATT&CK techniques and exploits 7 known CVEs.
Also known as
- Redaman
- RTM Locker
- G0048
- Origin
- Russia
- Techniques
- 22
- Exploited CVEs
- 7
- First seen
- Jan 1, 2015
- Last seen
- Aug 5, 2019
- Record updated
Who They Target.
Sectors · 2
About RTM.
RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM).
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.