{
  "family": "redyms",
  "sample_count": 10,
  "category": "ransomware",
  "description": "Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and search engine hijacking. It infects endpoints to form a massive botnet that silently simulates user clicks on pay-per-click (PPC) advertisements and artificially inflates search engine rankings, generating massive fraudulent revenue for the attackers at the expense of advertising networks.<br><br><b>Understanding Redyms (Click Fraud)</b><br>To the infected user, the malware is mostly invisible, aside from potential system sluggishness or unexplainable network bandwidth usage. For a security analyst, Redyms represents a sophisticated abuse of network resources. While it doesn't typically steal local files or deploy ransomware, it uses the corporate network's IP reputation to commit ad fraud, which can lead to the organization's IP space being blacklisted by major tech providers.<br><br><b>Execution and Fraud Mechanics</b><br>Redyms is typically distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates itself to evade detection (`T1027`). The core component is a hidden, headless browser engine. The malware connects to its Command and Control (C2) server to receive specific instructions (`T1105`). It is ordered to navigate to specific target URLs, search for specific keywords on major search engines (like Google or Yahoo), and silently click on specific ad links (`T1185`). To evade anti-fraud mechanisms, it spoofs user agents, clears cookies, and mimics human browsing behavior (like pausing before clicking).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network bandwidth consumption, performance degradation, and the potential blacklisting of the corporate IP address by major advertising or search networks. The primary IoCs are network-based: analysts will observe massive amounts of hidden HTTP/HTTPS traffic originating from the endpoint, primarily directed at ad networks, search engines, and known Redyms C2 servers. Host-based IoCs include EDR alerts for hidden, headless browser processes (like `iexplore.exe` running without a visible window).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1547.001",
    "T1027",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Hidden Ad Clicking)",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (C2 Communication for click instructions)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to halt the active click fraud and prevent further bandwidth consumption or IP reputation damage.",
    "Use EDR to locate and terminate the hidden processes (often disguised as system files or headless browsers) performing the automated clicks.",
    "Remove the persistence mechanisms (Registry Run keys and Scheduled Tasks) established by the malware.",
    "Monitor firewall logs to identify the C2 domains providing the click instructions, and block them enterprise-wide."
  ],
  "what_to_avoid": [
    "Do not ignore the infection simply because it isn't ransomware; click fraud botnets often rent out their infrastructure to deploy more severe payloads later.",
    "Avoid assuming standard ad-blockers will stop it; Redyms operates at the process level, bypassing browser-based extensions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}