Redyms

Overview

Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and search engine hijacking. It infects endpoints to form a massive botnet that silently simulates user clicks on pay-per-click (PPC) advertisements and artificially inflates search engine rankings, generating massive fraudulent revenue for the attackers at the expense of advertising networks.

Understanding Redyms (Click Fraud)
To the infected user, the malware is mostly invisible, aside from potential system sluggishness or unexplainable network bandwidth usage. For a security analyst, Redyms represents a sophisticated abuse of network resources. While it doesn't typically steal local files or deploy ransomware, it uses the corporate network's IP reputation to commit ad fraud, which can lead to the organization's IP space being blacklisted by major tech providers.

Execution and Fraud Mechanics
Redyms is typically distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates itself to evade detection (`T1027`). The core component is a hidden, headless browser engine. The malware connects to its Command and Control (C2) server to receive specific instructions (`T1105`). It is ordered to navigate to specific target URLs, search for specific keywords on major search engines (like Google or Yahoo), and silently click on specific ad links (`T1185`). To evade anti-fraud mechanisms, it spoofs user agents, clears cookies, and mimics human browsing behavior (like pausing before clicking).

Indicators of Compromise & Impact
The primary impact is network bandwidth consumption, performance degradation, and the potential blacklisting of the corporate IP address by major advertising or search networks. The primary IoCs are network-based: analysts will observe massive amounts of hidden HTTP/HTTPS traffic originating from the endpoint, primarily directed at ad networks, search engines, and known Redyms C2 servers. Host-based IoCs include EDR alerts for hidden, headless browser processes (like `iexplore.exe` running without a visible window).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_REDYMS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redyms"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "redyms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Redyms (Ransomware) Execution & Triage
id: 2cf9dde8-407a-551a-bd9b-66a5c1a590e2
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Redyms malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/redyms
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1185
- attack.t1547_001
- attack.t1027
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_REDYMS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redyms tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "redyms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to halt the active click fraud and prevent further bandwidth consumption or IP reputation damage.
2. Use EDR to locate and terminate the hidden processes (often disguised as system files or headless browsers) performing the automated clicks.
3. Remove the persistence mechanisms (Registry Run keys and Scheduled Tasks) established by the malware.
4. Monitor firewall logs to identify the C2 domains providing the click instructions, and block them enterprise-wide.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the infection simply because it isn't ransomware; click fraud botnets often rent out their infrastructure to deploy more severe payloads later.
2. Avoid assuming standard ad-blockers will stop it; Redyms operates at the process level, bypassing browser-based extensions.

References & External Analysis

• Search "redyms" on VirusTotal (External Analysis)
• Search "redyms" on Any.Run (Sandbox Sandbox)
• Search "redyms" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Scarab
• Cnnic
• Pincher
• Vkbase
• Ngvck
• Ardurk
• Msilbot
• Cerber

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/redyms.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.