Romcom Backdoor

The RomCom backdoor, a malicious software, is primarily used by the threat actor Void Rabisu, also known as Tropical Scorpius or Storm-0978. This malware has been associated with Cuba ransomware and has been notably deployed in cyberespionage activities, shifting away from opportunistic ransomware attacks. The group continues to develop this malware, even a year after this shift, with the latest version being dubbed "ROMCOM 4.0". Notably, the RomCom backdoor was used in typosquatting attacks targeting a July NATO summit. The payload spread by Void Rabisu has evolved over time, as evidenced by differences between recent versions and those analyzed in earlier research entries. One of the most notable exploits involves RTF (Rich Text Format) exploitation, which leads to an outbound connection downloading OLE (Object Linking & Embedding) streams into Office applications, subsequently deploying the RomCom backdoor. The final payload was a new variant of the ROMCOM backdoor, which has targeted industries such as cryptocurrency and regions including Europe, USA, and Latin America. The RomCom backdoor has been linked to various incidents of cyberattacks, including those against politicians in Ukraine and U.S.-based healthcare providers aiding refugees from Ukraine. In August, Void Rabisu leveraged the fourth version of the RomCom backdoor in its campaign against some participants at the Women Political Leaders (WPL) Summit in Brussels, indicating a growing shift in threat actors' goals towards more specific and strategic targets. The pro-Russian APT group known as Storm-0978, also referred to as the RomCom Group due to their use of the RomCom backdoor, has been attributed to these activities.