Void Rabisu

Void Rabisu, also known as Storm-0978, UNC2596, and Tropical Scorpius, is a malicious software (malware) notable for its use of the ROMCOM backdoor. This malware has been involved in numerous attacks, including those targeting attendees of the Women Political Leaders Summit (WPL Summit) in 2023. In August 2023, the actors behind Void Rabisu set up a deceptive website mimicking the legitimate WPL Summit site to lure visitors and exploit their systems. The malware was also used in spear-phishing attacks by a pro-Russian APT group against groups supporting Ukraine's admission into NATO in July 2023. The threat actor exhibited a shift in tactics during this period, deploying a different payload from the ROMCOM backdoor previously analyzed. Notably, Void Rabisu hijacked CLSID {F5078F32-C551-11D3-89B9-0000F81FE221}, typically used by the WordPad application. An updated and simplified ROMCOM RAT variant, dubbed PEAPOD, was used in attacks against female political leaders who participated in the WPL Summit. Additionally, Void Rabisu deployed the Cuba ransomware, potentially exclusively, as part of its attack strategies. Despite its sophisticated operations, there is no evidence to suggest that Void Rabisu is state-sponsored. According to researchers, the malware has stripped its backdoor "down to its core," downloading additional components as needed, possibly to make fingerprinting on the command and control server more difficult. The threat actor has also targeted other significant events, such as the Munich Security Conference and the Masters of Digital conference, underscoring the broad range of its malicious activities.