Romcom Group

The RomCom group, also known as Storm-0978, is a Russia-based threat actor identified for deploying the Underground ransomware. This group has been linked to various advanced cyber campaigns, with their tactics reflecting similarities to their previous attacks. The group's activities have been attributed by the cybersecurity community to a pro-Russian Advanced Persistent Threat (APT) group. Their notorious reputation stems from their use of the RomCom backdoor, which is an integral part of their malicious operations. The group's recent activity involves exploiting a remote code execution flaw, tracked as CVE-2023-36884. This bug was added by CISA to its list of known exploited vulnerabilities due to its significant risk to federal enterprises. The RomCom group, referred to as Storm-0978 by Microsoft, is known for using phishing emails to drop a backdoor of the same name, further demonstrating their sophisticated cyber attack strategies. The Underground ransomware, believed to be propagated by the RomCom group, presents a substantial threat. While the exact method of initial infection remains undisclosed, spear-phishing is suspected as the primary vector utilized by the group. Notably, on July 4th, two deceptive documents were discovered that were used as lures by the RomCom group, indicating their continued reliance on social engineering tactics for successful cyber intrusions.