The RomCom cyber threat group exploited zero-day vulnerabilities (CVE-2024-9680 and CVE-2024-49039) in Mozilla Firefox and Windows to deploy their backdoor. The vulnerabilities allowed zero-click exploitation, delivering payloads without user interaction. Fake websites were used to target victims worldwide, mainly in Europe and North America. The backdoor provided attackers with complete system control.
A Russian-speaking threat actor, tracked as UAT-5647 (also known as RomCom), has been observed targeting Ukrainian government entities and potentially Polish entities. The group has been utilizing a range of malware variants, including SingleCamper, RustyClaw, MeltingClaw, DustyHammock, and ShadyHammock, to establish long-term access, exfiltrate data, and potentially deploy ransomware. The malware variants demonstrate the group’s sophistication and diversity in their tooling and infrastructure. The targeting of edge devices within compromised networks suggests an escalation of the threat actor’s activity, potentially seeking to evade detection and gain even more control over the victim’s environment. Organizations in Ukraine and Poland should be particularly vigilant against this threat actor and implement robust security measures to protect their systems and data.
A new variant of the RomCom malware family, known as SnipBot, has been discovered. This sophisticated malware is designed to infiltrate enterprise networks, steal sensitive data, and provide attackers with remote access to compromised systems. SnipBot uses a multi-stage attack process to evade detection and maintain persistence on infected systems. This is a serious threat to enterprise security, and organizations need to be aware of this threat and take steps to protect their networks.