RAMBO Attack Spells Secrets in Radio From Air-Gapped PC RAM

How RAMBO turns memory into a transmitter

The core trick is mundane: reading and writing memory makes electronics emit weak radio-frequency noise. RAMBO shapes that noise into a message.

The arXiv paper, titled 'RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM,' describes malware that controls how the machine accesses its memory. By switching patterns on and off in a timed sequence, the attacker effectively spells out data in radio pulses.

A nearby receiver, which the researchers say can be a cheap software-defined radio, picks up the signal and reconstructs the file. The demonstration is a proof of concept, not a worm in the wild, but it follows a long line of air-gap exfiltration research that has used fans, USB ports, screen brightness and even power supplies as covert channels.

What makes RAMBO notable is that it does not require a speaker, a camera, a USB device or any networking chip. The memory itself becomes the antenna.

Why air-gapped machines are still a target

Air gaps protect the most sensitive systems: industrial controls, government networks, payment switches and research labs. That is exactly why attackers keep looking for ways around the gap.

If an adversary can plant malware on an isolated machine, the remaining problem is getting data out. RAMBO is one answer to that problem, and its requirements are worth stating plainly: the attacker needs code execution on the target, knowledge of the memory layout, and a receiver close enough to hear the signal.

In practical terms, that means a supply-chain compromise, an infected USB stick or a bribed insider could still set the stage. The radio link only closes the last mile.

This is the same pattern we saw with the Accenture contractor who hooked an AI agent to a Pentagon network: the hard part is rarely the exfiltration itself, but getting a foothold inside a trusted environment.

What defenders can actually do

There is no patch for physics, but there are mitigations.

Organisations that rely on air gaps should treat radio-frequency monitoring as part of their physical security, not an exotic extra. Shielding rooms, limiting what hardware enters a secure zone and watching for unexplained RF emissions all raise the cost of an attack like RAMBO.

The broader lesson is that isolation is a spectrum. Every air-gapped system still leaks something, and the job is to make sure what it leaks is not the thing you were protecting. As with the PHP2SHELL attacks on Palo Alto firewalls, the weakest point is often the assumption that a perimeter is enough.

What it means for you

For most readers in the US, UK and EU, RAMBO is not a home-network threat. It targets machines that are deliberately kept offline, and it requires malware to already be running on them.

The practical takeaway is for organisations: if you run an air-gapped environment, add radio-frequency checks to your threat model and keep a close eye on what gets plugged into isolated machines.

RAMBO is a reminder that security is physical as well as digital. The air gap still matters, but it is not a force field, and the researchers who keep proving that are doing defenders a favour.