Tropical Scorpius

Tropical Scorpius, also known as RomCom, Storm-0978, and UNC2596, is a threat actor group that has been active since at least late 2020. This Russian-based cybercrime group is associated with Cuba ransomware and the RomCom backdoor, and it has exploited various techniques such as Magic bytes, Process Doppelgänging, and Steganography to execute its malicious actions. The group targets diverse industries and regions, with a notable focus on the Cryptocurrency sector in Europe, the USA, and Latin America. They have also targeted Windows systems through different file types like DLL, EXE, PIF, and PNG. In June 2023, the group was implicated in attacks against politicians in Ukraine and U.S.-based healthcare providers aiding refugees from Ukraine. In these instances, they used malware such as DoubleFinger, GreetingGhoul, Remcos RAT, and a Loader-type malware. Later that year, in a wave of attacks starting in late 2023, Tropical Scorpius targeted Ukrainian government agencies and Polish entities. They also exploited two Firefox and Tor Browser zero-day vulnerabilities in attacks on users across Europe and North America. In another significant development, the group launched attacks against female political leaders who participated in the Women Political Leaders Summit in June using an updated and simplified RomCom RAT variant dubbed PEAPOD. These attacks were part of a broader campaign that also targeted attendees of the Munich Security Conference and the Masters of Digital conference. The group's activities underscore the need for robust cybersecurity measures across all sectors, particularly in high-profile events and critical industries.