RomCom

ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders. The ROMCOM backdoor is capable of stealing sensitive information and deploying other malware, showcasing the group's adaptability and growing sophistication.

Qrupun mənşəyi Rusiya kimi bildirilir.

Qrup 3 zərərli proqram ailəsi ilə əlaqələndirilib.

Digər adları: Storm-0978, UAT-5647

Qrup 3 zərərli proqram ailəsi ilə əlaqələndirilib.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass
• https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
• https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html

Mənbə: MISP Galaxy, Malpedia.