Redyms

Overview

Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and search engine hijacking. It infects endpoints to form a massive botnet that silently simulates user clicks on pay-per-click (PPC) advertisements and artificially inflates search engine rankings, generating massive fraudulent revenue for the attackers at the expense of advertising networks.

Understanding Redyms (Click Fraud)
To the infected user, the malware is mostly invisible, aside from potential system sluggishness or unexplainable network bandwidth usage. For a security analyst, Redyms represents a sophisticated abuse of network resources. While it doesn't typically steal local files or deploy ransomware, it uses the corporate network's IP reputation to commit ad fraud, which can lead to the organization's IP space being blacklisted by major tech providers.

Execution and Fraud Mechanics
Redyms is typically distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates itself to evade detection (`T1027`). The core component is a hidden, headless browser engine. The malware connects to its Command and Control (C2) server to receive specific instructions (`T1105`). It is ordered to navigate to specific target URLs, search for specific keywords on major search engines (like Google or Yahoo), and silently click on specific ad links (`T1185`). To evade anti-fraud mechanisms, it spoofs user agents, clears cookies, and mimics human browsing behavior (like pausing before clicking).

Indicators of Compromise & Impact
The primary impact is network bandwidth consumption, performance degradation, and the potential blacklisting of the corporate IP address by major advertising or search networks. The primary IoCs are network-based: analysts will observe massive amounts of hidden HTTP/HTTPS traffic originating from the endpoint, primarily directed at ad networks, search engines, and known Redyms C2 servers. Host-based IoCs include EDR alerts for hidden, headless browser processes (like `iexplore.exe` running without a visible window).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REDYMS {
    meta:
        description = "Detects Redyms (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "redyms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Redyms Activity
id: b2a9300afc69530bef4ec6dde7542b22
status: experimental
description: Detects generic indicators of the redyms malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*redyms*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint to halt the active click fraud and prevent further bandwidth consumption or IP reputation damage.
2. Use EDR to locate and terminate the hidden processes (often disguised as system files or headless browsers) performing the automated clicks.
3. Remove the persistence mechanisms (Registry Run keys and Scheduled Tasks) established by the malware.
4. Monitor firewall logs to identify the C2 domains providing the click instructions, and block them enterprise-wide.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the infection simply because it isn't ransomware; click fraud botnets often rent out their infrastructure to deploy more severe payloads later.
2. Avoid assuming standard ad-blockers will stop it; Redyms operates at the process level, bypassing browser-based extensions.

References & External Analysis

• Search "redyms" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Babonock
• Genericrxeg
• Krament
• Quasarrat
• Pcrepair

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/redyms.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.