Unc2596

UNC2596, also known as Void Rabisu, Tropical Scorpius, and Storm-0978, is a hybrid threat actor involved in both financially motivated and espionage attacks. This group has been refining its tactics and techniques, utilizing backdoor attacks that have targeted various high-profile events, including the Munich Security Conference and the Masters of Digital conference. The cybersecurity firm Trend Micro has been tracking this threat actor, which is also believed to be associated with Cuba ransomware. In October 2023, UNC2596 launched a series of targeted attacks against female political leaders who participated in the Women Political Leaders Summit in June. These attacks utilized an updated and simplified variant of the RomCom RAT (Remote Access Trojan) malware, dubbed PEAPOD. This new variant was specifically used by UNC2596, indicating an evolution in the group's capabilities and strategies. The attribution of these attacks to UNC2596 is based on a combination of factors including tactics, techniques, and procedures (TTPs), code similarity, and attack infrastructure. The group's focus on targeting women leaders within the European Union’s military and political circles represents a notable shift in its target demographic. As such, it's imperative for organizations and individuals alike to remain vigilant and employ robust cybersecurity measures to mitigate the risk posed by this threat actor.