Alias Description | Votes |
---|---|
Romcom Backdoor is a possible alias for RomCom. The RomCom backdoor is a malicious software (malware) primarily utilized by the threat actor Void Rabisu, which has been linked to the pro-Russian APT group known as Storm-0978 or the RomCom Group. The malware is typically spread through deceptive websites that redirect potential victims to a server | 7 |
Peapod is a possible alias for RomCom. Peapod is a sophisticated form of malware that has evolved from the RomCom 3.0 backdoor. The cybercriminal group Void Rabisu appears to have transitioned from using RomCom 3.0 to Peapod, which exhibits several architectural differences compared to its predecessor. This new strain, also referred to a | 6 |
Tropical Scorpius is a possible alias for RomCom. Tropical Scorpius, also known as RomCom, Storm-0978, and UNC2596, is a threat actor group that has been active since at least late 2020. This Russian-based cybercrime group is associated with Cuba ransomware and the RomCom backdoor, and it has exploited various techniques such as Magic bytes, Proces | 3 |
Unc2596 is a possible alias for RomCom. UNC2596, also known as RomCom, Storm-0978, Tropical Scorpius, and Void Rabisu, is a Russian-based cybercrime group that has executed a series of attacks across Europe and North America. The threat actor has exploited two zero-day vulnerabilities in Firefox and Tor Browser in its recent operations. R | 3 |
Romcom Remote Access Trojan is a possible alias for RomCom. The RomCom Remote Access Trojan (RAT) is a harmful malware that has been evolving and causing significant threats to cybersecurity. Based on the RomCom 3.0 version, it incorporates techniques seen in RomCom 4.0, resulting in the creation of RomCom 5.0. This malware can infiltrate systems via suspici | 3 |
Snipbot is a possible alias for RomCom. SnipBot is a malicious software program that was first identified in Ukraine and submitted to VirusTotal in December 2023. It uses a custom obfuscation technique and advanced anti-analysis tricks to infiltrate systems undetected. The malware's execution flow begins with an initial EXE downloader, wh | 3 |
Romcom Group is a possible alias for RomCom. The RomCom group, also known as Storm-0978, is a Russia-based threat actor identified for deploying the Underground ransomware. This group has been linked to various advanced cyber campaigns, with their tactics reflecting similarities to their previous attacks. The group's activities have been attri | 2 |
Alias Description | Association Type | Votes |
---|---|---|
The Cuba Ransomware Malware is associated with RomCom. The Cuba ransomware is a malicious software that first appeared on cybersecurity radars in late 2020 under the name "Tropical Scorpius." It is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user's knowledge. Once insi | Unspecified | 3 |
Alias Description | Association Type | Votes |
---|---|---|
The Void Rabisu Threat Actor is associated with RomCom. Void Rabisu, also known as Storm-0978, UNC2596, and Tropical Scorpius, is a malicious software (malware) notable for its use of the ROMCOM backdoor. This malware has been involved in numerous attacks, including those targeting attendees of the Women Political Leaders Summit (WPL Summit) in 2023. In | has used | 3 |
The Storm-0978 Threat Actor is associated with RomCom. Storm-0978, also known as RomCom or DEV-0978, is a threat actor group alleged to have connections with Russia. Microsoft, in a blog post published on July 11, 2023, accused this group of exploiting the vulnerability CVE-2023-36884 to install backdoors on target systems. The cybersecurity industry ha | is related to | 2 |
Alias Description | Association Type | Votes |
---|---|---|
The CVE-2023-36884 Vulnerability is associated with RomCom. CVE-2023-36884 is a significant software vulnerability that affects Microsoft Windows, Server, Office, and Outlook. This flaw in the design or implementation of these software platforms allows for remote code execution (RCE), which has been exploited by cybercriminals and potentially state-sponsored | Unspecified | 3 |
The vulnerability CVE-2024-9680 is associated with RomCom. | Unspecified | 2 |
Preview | Source Link | CreatedAt | Title |
---|---|---|---|
Securityaffairs | 5 days ago | ||
InfoSecurity-magazine | 5 days ago | ||
DARKReading | 5 days ago | ||
Checkpoint | a month ago | ||
Securityaffairs | 2 months ago | ||
Contagio | 2 months ago | ||
DARKReading | 2 months ago | ||
Unit42 | 2 months ago | ||
Flashpoint | 6 months ago | ||
CERT-EU | 9 months ago | ||
CERT-EU | a year ago | ||
CERT-EU | a year ago | ||
CERT-EU | a year ago | ||
Unit42 | a year ago | ||
BankInfoSecurity | a year ago | ||
CERT-EU | a year ago | ||
CERT-EU | a year ago | ||
CERT-EU | a year ago | ||
DARKReading | a year ago | ||
InfoSecurity-magazine | a year ago |