{
  "family": "ramdo",
  "sample_count": 8,
  "category": "click_fraud",
  "description": "Ramdo is a click-fraud trojan family that uses infected machines to generate fraudulent ad clicks, draining advertising budgets and inflating ad-network metrics. It uses encrypted command-and-control communication and modular plugin architecture. Symantec disrupted Ramdo infrastructure in 2015.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ramdo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ramdo is a click-fraud trojan family that uses infected machines to generate fraudulent ad clicks, draining advertising budgets and inflating ad-network metrics. It uses encrypted command-and-control communication and modular plugin architecture. Symantec disrupted Ramdo infrastructure in 2015."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ramdo spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ramdo is a click-fraud trojan distributed through exploit kits and pay-per-install affiliate networks, generating fraudulent ad clicks from infected hosts."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of a Ramdo infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sustained background HTTP traffic to ad networks while no browser is open, high CPU from hidden processes, and AV references to Ramdo indicate the infection."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Ramdo on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}