RomCom

The RomCom malware, a Remote Access Trojan (RAT), has been linked to Cuba ransomware actors and Industrial Spy ransomware actors, according to third-party and open-source reports. Since spring 2022, the Russian-speaking group UAT-5647, also known as RomCom, has targeted Ukrainian government entities and Polish organizations with updated variants of RomCom malware. This year, these actors have added new techniques to their tactics, techniques, and procedures (TTPs), enhancing their capabilities for network reconnaissance, data exfiltration, and establishing remote tunnels between targeted endpoints and attacker-controlled servers. RomCom's recent attacks have seen an increase in data exfiltration from Ukrainian targets, marking a shift from its previous focus on ransomware attacks and cyber espionage campaigns. The group has deployed an updated variant of the RomCom RAT, dubbed 'SingleCamper,' which is loaded directly from the registry into memory and uses a loopback address for communication with its loader. Since late 2023, the Russia-linked threat actor has launched a new wave of attacks against Ukrainian government agencies and Polish entities. The RomCom threat actor, active since at least 2022, is interested in cyber espionage against Ukraine and its supporters. The Computer Emergency Response Team of Ukraine (CERT-UA) has published information about the group and its operations. The latest version of the malware, SNIPBOT RomCom, integrates novel obfuscation techniques and exhibits distinct post-infection activities not seen in previous variants. Despite ongoing efforts to counteract its activities, RomCom remains an active threat, engaging in various nefarious activities including ransomware, extortion, and targeted credential gathering to support intelligence-gathering operations.