Malware analysts have found multiple samples of a new malware toolkit that can collect sensitive files from systems isolated from the internet. They call it Ramsay and there are few known victims to date. It lands on a victim computer via a malicious RTF file and scans removable drives and network shares for Word documents, PDF files, and ZIP archives. At least three variants of this malware exist, though: v1, v2.a, v 2.b, and v1.a. The spreader component in this version is highly aggressive, researcher Ignacio Sanmillan says.
Source: https://www.bleepingcomputer.com/news/security/new-ramsay-malware-steals-files-from-air-gapped-computers/