Tropical Scorpius

Tropical Scorpius is a notorious malware, first identified in late 2020, associated with the Cuba ransomware gang. This malicious software has been linked to multiple cybercriminal activities, including disrupting operations, stealing personal information, and holding data hostage for ransom. The malware infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. The threat actor, also known as Void Rabisu, Storm-0978, and UNC2596, targets a wide range of industries and regions, notably the cryptocurrency industry, Europe, the USA, and Latin America. In June 2023, the RomCom threat group, associated with Tropical Scorpius and Cuba ransomware, resurfaced targeting politicians in Ukraine and U.S.-based healthcare providers aiding refugees from Ukraine. Furthermore, in August of the same year, the group leveraged the fourth version of the RomCom backdoor in its campaign against attendees of the Women Political Leaders (WPL) Summit in Brussels. The malware variants used included DoubleFinger, GreetingGhoul, Remcos RAT, and others, delivered through file types such as DLL, EXE, PIF, and PNG. By October 2023, the group had launched attacks using an updated and simplified RomCom RAT variant dubbed PEAPOD against female political leaders who participated in the WPL Summit. These attacks were part of a broader strategy of both financially motivated and espionage attacks, demonstrating the hybrid nature of this threat actor. Techniques employed by Tropical Scorpius include Magic bytes, Process Doppelgänging, and Steganography, primarily targeting Windows systems.