Romcom Backdoor

The RomCom backdoor is a malicious software (malware) primarily utilized by the threat actor Void Rabisu, which has been linked to the pro-Russian APT group known as Storm-0978 or the RomCom Group. The malware is typically spread through deceptive websites that redirect potential victims to a server hosting an exploit. If successful, shellcode is executed that downloads and runs the RomCom backdoor on the victim's computer. This activity is often associated with cyberespionage and ransomware attacks, with a particular emphasis on the cryptocurrency industry in Europe, USA, and Latin America. Almost a year after shifting its focus from opportunistic ransomware attacks to cyberespionage, Void Rabisu continued to develop the RomCom backdoor. An updated version of this malware, dubbed "ROMCOM 4.0" or "PEAPOD," was identified as the final payload in several attacks. The compromise chain involved a fake website that redirected the potential victim to the server hosting the exploit; if the exploit succeeded, shellcode was executed that downloaded and executed the RomCom backdoor. Notably, this malware was found to exploit Firefox and Windows zero-days in the wild. RomCom backdoor has been used in various targeted attacks, including those against politicians in Ukraine and U.S.-based healthcare providers offering aid to refugees from Ukraine. The malware was also deployed in typosquatting attacks aimed at a July NATO summit. The BlackBerry research team reported that the exploit uses RTF (Rich Text Format) exploitation, leading to an outbound connection downloading OLE (Object Linking & Embedding) streams into the Office application, further deploying the RomCom backdoor.