Romcom Backdoor

Malware updated 15 days ago (2024-11-29T13:58:23.568Z)
Download STIX
Preview STIX
The RomCom backdoor is a malicious software (malware) primarily utilized by the threat actor Void Rabisu, which has been linked to the pro-Russian APT group known as Storm-0978 or the RomCom Group. The malware is typically spread through deceptive websites that redirect potential victims to a server hosting an exploit. If successful, shellcode is executed that downloads and runs the RomCom backdoor on the victim's computer. This activity is often associated with cyberespionage and ransomware attacks, with a particular emphasis on the cryptocurrency industry in Europe, USA, and Latin America. Almost a year after shifting its focus from opportunistic ransomware attacks to cyberespionage, Void Rabisu continued to develop the RomCom backdoor. An updated version of this malware, dubbed "ROMCOM 4.0" or "PEAPOD," was identified as the final payload in several attacks. The compromise chain involved a fake website that redirected the potential victim to the server hosting the exploit; if the exploit succeeded, shellcode was executed that downloaded and executed the RomCom backdoor. Notably, this malware was found to exploit Firefox and Windows zero-days in the wild. RomCom backdoor has been used in various targeted attacks, including those against politicians in Ukraine and U.S.-based healthcare providers offering aid to refugees from Ukraine. The malware was also deployed in typosquatting attacks aimed at a July NATO summit. The BlackBerry research team reported that the exploit uses RTF (Rich Text Format) exploitation, leading to an outbound connection downloading OLE (Object Linking & Embedding) streams into the Office application, further deploying the RomCom backdoor.
Description last updated: 2024-11-28T11:54:04.348Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
RomCom is a possible alias for Romcom Backdoor. RomCom, a malicious software, has been identified as a significant cyber threat. Reports from third-party and open-source intelligence since spring 2022 have indicated a connection between RomCom Remote Access Trojan (RAT) actors, Cuba ransomware actors, and Industrial Spy ransomware actors. The mal
8
Romcom Group is a possible alias for Romcom Backdoor. The RomCom group, also known as Storm-0978, is a Russia-based threat actor identified for deploying the Underground ransomware. This group has been linked to various advanced cyber campaigns, with their tactics reflecting similarities to their previous attacks. The group's activities have been attri
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Exploit
Malware
Ransomware
Backdoor
Microsoft
Apt
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The Void Rabisu Threat Actor is associated with Romcom Backdoor. Void Rabisu, also known as Storm-0978, UNC2596, and Tropical Scorpius, is a malicious software (malware) notable for its use of the ROMCOM backdoor. This malware has been involved in numerous attacks, including those targeting attendees of the Women Political Leaders Summit (WPL Summit) in 2023. In has used
3
Source Document References
Information about the Romcom Backdoor Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Securityaffairs
16 days ago
InfoSecurity-magazine
16 days ago
DARKReading
16 days ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Unit42
a year ago
BankInfoSecurity
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Trend Micro
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
InfoSecurity-magazine
a year ago