TA829

No known aliases in database

▲ High Threat

TA829 RomCom RAT and MikroTik phishing campaign, TA829 and UNK_GreenSec shared malware campaign

Origin Russia

Motivation financial gain (with occasional espionage aligned with Russian interests)

Known TTPs

Use of RomCom RAT

Exploitation of zero-day vulnerabilities

Compromise of MikroTik routers for REM Proxy service

Phishing via freemail accounts

Financial fraud

Espionage

CISA Advisories ↗

Hacking the mainframe…