Click-Fraud Ramdo Malware Family Continues to Plague Users
Summary: Unit 42 and Dell Secureworks Counter Threat Unit published joint research on Ramdo, a click-fraud malware family first seen in late 2013 that spreads mainly through exploit kits and was analyzed via a sample compiled January 22, 2016. The malware unpacks a DLL from a packed dropper, decrypts strings with a single-byte XOR key, checks for sandboxes and virtualized environments, generates 20 domains from hardcoded seeds, and downloads the Chromium Embedded Framework to crawl ad links and perform fraudulent clicks.
Bottom line: Ramdo's operators can change the ad links it visits at will, and the RSA public key used to encrypt its command-and-control traffic has already changed since Microsoft first analyzed the malware, so the threat keeps evolving while infected machines keep clicking.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026