Threat Investigation
Request a demo
State-sponsored

RomCom

RomCom is classified as state-sponsored.

Malware families
3
Origin
Russia
Also known as
2

ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders. The ROMCOM backdoor is capable of stealing sensitive information and deploying other malware, showcasing the group's adaptability and growing sophistication.

The group's reported origin is Russia.

The group is associated with 3 malware families.

Also known as: Storm-0978, UAT-5647

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

RomCom · Threat actors · Dark Radar