RomCom

The RomCom malware, a malicious software that has been active since 2022, is an ongoing cyber threat. This Remote Access Trojan (RAT) is known for its various harmful activities including ransomware attacks, extortion, and targeted credential gathering, primarily aimed at supporting intelligence-gathering operations. Recently, a new variant of this malware, dubbed SnipBot by Palo Alto's Unit 42 researchers, has been discovered, integrating novel obfuscation techniques and exhibiting unique post-infection activities not seen in previous variants such as RomCom 3.0 and PEAPOD/RomCom 4.0. This latest version appears to have been spreading since December, picking up where the last version of RomCom left off. This year, there have been significant developments in the tactics, techniques, and procedures (TTPs) of Cuba ransomware actors. Reports from third-party and open-source platforms suggest a possible link between these actors, RomCom RAT actors, and Industrial Spy ransomware actors. This connection suggests a complex web of cyber threats involving multiple types of malware. The RomCom threat actor has shown particular interest in cyber espionage against Ukraine and its supporters, often deploying ransomware payloads alongside their cyber-espionage activities. Despite occasional instances of ransomware being dropped on systems infected with RomCom in the past, no such incidents were observed in the recent cases studied by Sophos or in our own investigations. The Computer Emergency Response Team of Ukraine (CERT-UA) has published information about the threat group and its operation, given the actor's interest in targeting Ukrainian defense enterprises. It is clear that the RomCom malware remains an active threat, evolving with new versions and strategies, requiring vigilant cybersecurity measures.