RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM

Researchers led by Mordechai Guri have unveiled RAMBO, a new attack technique that leaks data from air-gapped computers by generating covert radio signals from a system's RAM, according to a paper accepted to the Nordic Conference on Secure IT Systems 2023. The malware encodes sensitive information—including files, images, keylogging data, biometric information, and encryption keys—into software-generated radio signals emitted from memory buses, which an attacker can intercept from a distance using software-defined radio (SDR) hardware and an off-the-shelf antenna. The technique achieves data exfiltration speeds of up to 1000 bits per second, a significant improvement over prior air-gap attack methods. The finding matters because air-gapped systems are used in sensitive environments like critical infrastructure, government, and military networks where isolation is assumed to prevent data theft, and this attack undermines that core security assumption. The paper also proposes countermeasures to mitigate the threat, and organizations in defense, finance, and critical infrastructure should watch for guidance on RAM-bus emissions monitoring, RF shielding, and related detection tools as this attack class matures.