Unc2596

UNC2596, also known as Void Rabisu, Tropical Scorpius, and Storm-0978, is a hybrid threat actor involved in both financially motivated and espionage attacks. This group has been active since at least late 2023, with cybersecurity firm Trend Micro identifying the group's activities of honing a backdoor in attacks that included attendees of the Munich Security Conference and the Masters of Digital conference. Additionally, Cisco Talos researchers have observed this Russia-linked threat actor targeting Ukrainian government agencies and Polish entities in a new wave of attacks. The threat actor has used a variety of tools in its operations, including an updated and simplified RomCom RAT variant dubbed PEAPOD. Notably, this variant was used in a series of attacks against female political leaders who participated in the Women Political Leaders Summit in June 2023. These attacks were launched by the Void Rabisu operation, further demonstrating the group's broad range of targets and capabilities. Recent developments have revealed an intriguing focus within UNC2596's operations. The group has specifically targeted women leaders within the European Union’s military and political circles, leading to increased concerns about the potential implications of these targeted attacks. Furthermore, it's believed that UNC2596 is associated with Cuba ransomware, suggesting a multifaceted approach to its cyber operations that includes both direct cyberattacks and disruptive ransomware campaigns.