{
  "family": "redyms",
  "sample_count": 10,
  "category": "ransomware",
  "description": "Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and search engine hijacking. It infects endpoints to form a massive botnet that silently simulates user clicks on pay-per-click (PPC) advertisements and artificially inflates search engine rankings, generating massive fraudulent revenue for the attackers at the expense of advertising networks.<br><br><b>Understanding Redyms (Click Fraud)</b><br>To the infected user, the malware is mostly invisible, aside from potential system sluggishness or unexplainable network bandwidth usage. For a security analyst, Redyms represents a sophisticated abuse of network resources. While it doesn't typically steal local files or deploy ransomware, it uses the corporate network's IP reputation to commit ad fraud, which can lead to the organization's IP space being blacklisted by major tech providers.<br><br><b>Execution and Fraud Mechanics</b><br>Redyms is typically distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates itself to evade detection (`T1027`). The core component is a hidden, headless browser engine. The malware connects to its Command and Control (C2) server to receive specific instructions (`T1105`). It is ordered to navigate to specific target URLs, search for specific keywords on major search engines (like Google or Yahoo), and silently click on specific ad links (`T1185`). To evade anti-fraud mechanisms, it spoofs user agents, clears cookies, and mimics human browsing behavior (like pausing before clicking).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network bandwidth consumption, performance degradation, and the potential blacklisting of the corporate IP address by major advertising or search networks. The primary IoCs are network-based: analysts will observe massive amounts of hidden HTTP/HTTPS traffic originating from the endpoint, primarily directed at ad networks, search engines, and known Redyms C2 servers. Host-based IoCs include EDR alerts for hidden, headless browser processes (like `iexplore.exe` running without a visible window).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Redyms and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redyms is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redyms establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redyms typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Redyms compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Redyms should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Redyms employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redyms typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Redyms, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Redyms depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1547.001",
    "T1027",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Hidden Ad Clicking)",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (C2 Communication for click instructions)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to halt the active click fraud and prevent further bandwidth consumption or IP reputation damage.",
    "Use EDR to locate and terminate the hidden processes (often disguised as system files or headless browsers) performing the automated clicks.",
    "Remove the persistence mechanisms (Registry Run keys and Scheduled Tasks) established by the malware.",
    "Monitor firewall logs to identify the C2 domains providing the click instructions, and block them enterprise-wide."
  ],
  "what_to_avoid": [
    "Do not ignore the infection simply because it isn't ransomware; click fraud botnets often rent out their infrastructure to deploy more severe payloads later.",
    "Avoid assuming standard ad-blockers will stop it; Redyms operates at the process level, bypassing browser-based extensions."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}