Peapod

Malware Profile Updated 3 months ago
Download STIX
Preview STIX
PEAPOD, a novel variant of the RomCom RAT malware, was discovered to have been used in targeted attacks against female political leaders who participated in the Women Political Leaders Summit in June. The threat operation responsible for these attacks is known as Void Rabisu, also referred to as Storm-0978, UNC2596, and Tropical Scorpius. Comparisons between PEAPOD and its predecessor, ROMCOM 3.0, reveal that Void Rabisu has temporarily halted the use of ROMCOM 3.0 and transitioned to delivering PEAPOD, which exhibits some architectural differences. PEAPOD forces WinHTTP functions to use TLS 1.2 instead of the default version chosen by the operating system and cannot infect systems running Windows 7 and earlier versions. It was delivered using an exploit chain that included CVE-2023-36584 and CVE-2023-36884, vulnerabilities patched by Microsoft in October and July 2023 respectively. Despite its unique architecture, it is still possible for systems infected by PEAPOD to download a third component similar to the ROMCOM 3.0 worker, granting threat actors the same level of control over victims as with ROMCOM 3.0. The final payload of PEAPOD is a new version of the ROMCOM backdoor, dubbed “ROMCOM 4.0”. This information was confirmed through a sample of PEAPOD shared by an anonymous source. While the shift from ROMCOM 3.0 to PEAPOD represents an evolution in Void Rabisu's attack strategy, the overall aim remains the same - to gain unauthorized access and control over targeted systems. The discovery of PEAPOD underscores the need for continuous vigilance and regular system updates to guard against evolving cyber threats.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
RomCom
4
RomCom is a type of malware, specifically a Remote Access Trojan (RAT), that has been linked to several cyber-attacks across Europe and North America. It was first identified in spring 2022, when third-party and open-source reports highlighted a potential connection between Cuba ransomware actors, R
Void Rabisu
3
Void Rabisu, also known as Storm-0978, UNC2596, and Tropical Scorpius, is a malicious software (malware) notable for its use of the ROMCOM backdoor. This malware has been involved in numerous attacks, including those targeting attendees of the Women Political Leaders Summit (WPL Summit) in 2023. In
Tropical Scorpius
1
Tropical Scorpius is a notorious malware, first identified in late 2020, associated with the Cuba ransomware gang. This malicious software has been linked to multiple cybercriminal activities, including disrupting operations, stealing personal information, and holding data hostage for ransom. The ma
Romcom Backdoor
1
The RomCom backdoor, a malicious software, is primarily used by the threat actor Void Rabisu, also known as Tropical Scorpius or Storm-0978. This malware has been associated with Cuba ransomware and has been notably deployed in cyberespionage activities, shifting away from opportunistic ransomware a
Unc2596
1
UNC2596, also known as Void Rabisu, Tropical Scorpius, and Storm-0978, is a hybrid threat actor involved in both financially motivated and espionage attacks. This group has been refining its tactics and techniques, utilizing backdoor attacks that have targeted various high-profile events, including
Romcom Rat
1
RomCom RAT, a type of malware, has been linked to Cuba ransomware and Industrial Spy ransomware actors since spring 2022. These malicious actors have been observed deploying the RomCom RAT and Meterpreter Reverse Shell HTTP/HTTPS proxy via a Command and Control (C2) server before initiating their ra
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Windows
Payload
Malware
Backdoor
Vulnerability
Exploit
Ransomware
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CubaUnspecified
1
The Cuba ransomware, a malicious software active since 2019, has been linked to a series of escalating attacks on US entities and European leaders. The criminal group behind the malware, known by various aliases such as Void Rabisu, UNC2596, Tropical Scorpius, and Storm-0978, has recently targeted w
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CVE-2023-36884Unspecified
1
CVE-2023-36884 is a significant software vulnerability discovered in Microsoft Windows, Server, Office, and Outlook. It is a flaw in the software design or implementation that allows for remote code execution (RCE), specifically in the Windows Search security feature. This vulnerability was being ac
CVE-2023-36584Unspecified
1
None
Source Document References
Information about the Peapod Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
Trend Micro
9 months ago
Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
CERT-EU
8 months ago
CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog
CERT-EU
9 months ago
SpyNote Android trojan detailed
CERT-EU
9 months ago
Android spyware deployed via fraudulent Israeli rocket alert app
BankInfoSecurity
9 months ago
Women Political Leaders Targeted With RomCom RAT Variant
CERT-EU
9 months ago
RomCom Malware Group Targets EU Gender Equality Summit
CERT-EU
9 months ago
Israel, Gaza relief groups subjected to DDoS attacks
CERT-EU
9 months ago
Novel RomCom RAT variant used in attacks against female political leaders
CERT-EU
9 months ago
Ransomware attack claims against Colonial Pipeline linked to third-party breach
CERT-EU
9 months ago
Google trending Ransomware news headlines for the day - Cybersecurity Insiders
CERT-EU
9 months ago
New PEAPOD Cyberattack Campaign Targeting Women Political Leaders
CERT-EU
9 months ago
New PEAPOD Cyberattack Campaign Targeting Women Political Leaders