Peapod

Peapod is a sophisticated form of malware that has evolved from the RomCom 3.0 backdoor. The cybercriminal group Void Rabisu appears to have transitioned from using RomCom 3.0 to Peapod, which exhibits several architectural differences compared to its predecessor. This new strain, also referred to as RomCom 4.0 by Trend Micro, incorporates techniques observed in both RomCom 3.0 and its offshoot Peapod, along with new tricks and unique code obfuscation methods. Despite these advancements, Peapod still allows for similar levels of control over infected systems as RomCom 3.0, as evidenced by commands listed in Table 3. The deployment of Peapod was facilitated by an exploit chain involving two vulnerabilities: CVE-2023-36584 and CVE-2023-36884. Both of these Windows remote code execution vulnerabilities were patched by Microsoft in October and July 2023 respectively. The malware forces WinHTTP functions to use TLS 1.2 instead of the default version chosen by the operating system, demonstrating a level of sophistication in its approach to system infiltration. However, it's worth noting that our analysis suggests Peapod cannot infect systems running Windows 7 and earlier versions. In summary, Peapod represents an evolution of the RomCom malware, incorporating advanced techniques and exploiting known vulnerabilities to infiltrate systems. While there are key differences between RomCom 3.0 and Peapod, the latter maintains a similar level of control over victim systems. It's essential for organizations to ensure their systems are updated with the latest patches to protect against such threats.