Tropical Scorpius

Tropical Scorpius, also known as Void Rabisu, Storm-0978, and UNC2596, is a significant threat actor in the cybersecurity landscape. Initially appearing on the radar in late 2020, the group gained notoriety for its deployment of Cuba ransomware and association with the RomCom backdoor. This malicious entity has been linked to various types of malware such as DoubleFinger, GreetingGhoul, Remcos RAT, and an updated RomCom RAT variant named PEAPOD. Their preferred techniques include Magic bytes, Process Doppelgänging, and Steganography, often delivered via DLL, EXE, PIF, and PNG files. The group has targeted industries like Cryptocurrency and systems running Windows. Throughout 2023, Tropical Scorpius executed a series of sophisticated cyberattacks against multiple targets, primarily in Europe, the USA, and Latin America. In June 2023, the group was associated with attacks targeting Ukrainian politicians and U.S.-based healthcare providers aiding Ukrainian refugees. Later in the year, they launched a new wave of attacks targeting Ukrainian government agencies and Polish entities. Furthermore, Cisco Talos researchers observed the group's links with Russia, suggesting geopolitical motivations behind their activities. In August and October 2023, Tropical Scorpius made headlines again by leveraging an updated RomCom RAT variant dubbed PEAPOD in its campaigns. These attacks targeted female political leaders who participated in the Women Political Leaders Summit in June. Additionally, the group honed a backdoor in attacks that included attendees of the Munich Security Conference and the Masters of Digital conference. This ongoing activity demonstrates Tropical Scorpius's adaptability and persistent threat to global cybersecurity.