Unc2596

UNC2596, also known as RomCom, Storm-0978, Tropical Scorpius, and Void Rabisu, is a Russian-based cybercrime group that has executed a series of attacks across Europe and North America. The threat actor has exploited two zero-day vulnerabilities in Firefox and Tor Browser in its recent operations. Researchers from TrendMicro have identified UNC2596's modus operandi to include the development of a backdoor in its attacks, targeting high-profile events such as the Munich Security Conference and the Masters of Digital conference. Since late 2023, UNC2596 has been observed by Cisco Talos researchers launching a new wave of attacks against Ukrainian government agencies and Polish entities. In addition, an updated and simplified variant of the RomCom RAT dubbed PEAPOD was used by the threat actor to target female political leaders who participated in the Women Political Leaders Summit in June. These attacks show a clear pattern of both financial and espionage motives, demonstrating the group's hybrid threat capabilities. The threat posed by UNC2596 is significant due to its wide-ranging targets and sophisticated techniques. Its ability to exploit zero-day vulnerabilities and develop new variants of malware for targeted attacks indicates a high level of technical skill and adaptability. With the group actively targeting political figures and governmental agencies, it underscores the importance of robust cybersecurity measures to mitigate these threats.