สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool RMS

Threat Group Cards: A Threat Actor Encyclopedia

Tool: RMS

Names	RMS Remote Manipulator System Gussdoor RuRAT
Category	Tools
Type	Backdoor, Info stealer
Description	CyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.
Information	<https://rmansys.ru/remote-access/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.rms>

Last change to this tool card: 30 November 2023

Download this tool card in JSON format

All groups using tool RMS

Changed	Name	Country	Observed
APT groups
	Gamaredon Group		2013-Feb 2025
	LazyScripter	[Unknown]	2018
	TA505, Graceful Spider, Gold Evergreen		2006-Nov 2022

3 groups listed (3 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]