RomCom RAT Targeting NATO and Ukraine Support Groups

The menace actors guiding the RomCom RAT have been suspected of phishing attacks targeting the future NATO Summit in Vilnius as nicely as an identified organization supporting Ukraine abroad.

The conclusions appear from the BlackBerry Menace Research and Intelligence team, which identified two destructive documents submitted from a Hungarian IP address on July 4, 2023.

RomCom, also tracked beneath the names Tropical Scorpius, UNC2596, and Void Rabisu, was not too long ago noticed staging cyber attacks in opposition to politicians in Ukraine who are functioning intently with Western nations around the world and a U.S.-centered healthcare corporation involved with aiding refugees fleeing the war-torn region.

Attack chains mounted by the team are geopolitically motivated and have utilized spear-phishing e-mail to issue victims to cloned internet sites hosting trojanized versions of well-liked software program. Targets include militaries, food provide chains, and IT providers.

The hottest lure files identified by BlackBerry impersonate Ukrainian Entire world Congress, a genuine non-gain, (“Overview_of_UWCs_UkraineInNATO_marketing campaign.docx”) and function a bogus letter declaring help for Ukraine’s inclusion to NATO (“Letter_NATO_Summit_Vilnius_2023_ENG(1).docx”).

“Though we have not still uncovered the original an infection vector, the menace actor most likely relied on spear-phishing tactics, engaging their victims to click on on a specially crafted duplicate of the Ukrainian Globe Congress internet site,” the Canadian firm stated in an examination released last 7 days.

Opening the file triggers a innovative execution sequence that involves retrieving intermediate payloads from a remote server, which, in change, exploits Follina (CVE-2022-30190), a now-patched security flaw influencing Microsoft’s Help Diagnostic Software (MSDT), to reach distant code execution.

Approaching WEBINAR🔐 Privileged Entry Management: Discover How to Conquer Key Challenges

Explore distinct approaches to conquer Privileged Account Management (PAM) worries and amount up your privileged access security technique.

Reserve Your Place

The consequence is the deployment of RomCom RAT, an executable created in C++ that’s built to gather details about the compromised technique and remote commandeer it.

“Dependent on the mother nature of the upcoming NATO Summit and the related lure paperwork sent out by the threat actor, the intended victims are representatives of Ukraine, international businesses, and individuals supporting Ukraine,” BlackBerry stated.

“Centered on the accessible information and facts, we have medium to substantial self esteem to conclude that this is a RomCom rebranded operation, or that one particular or far more users of the RomCom danger team are powering this new marketing campaign supporting a new threat team.”

Uncovered this post interesting? Follow us on Twitter  and LinkedIn to read a lot more unique material we write-up.

Some elements of this short article are sourced from:
thehackernews.com