Security News > 2023 > July > RomCom hackers target NATO Summit attendees in phishing attacks
A threat actor referred to as 'RomCom' has been targeting organizations supporting Ukraine and guests of the upcoming NATO Summit set to start tomorrow in Vilnius, Lithuania.
BlackBerry's research and intelligence team recently discovered two malicious documents that impersonated the Ukranian World Congress organization and topics related to the NATO Summit to lure selected targets.
BlackBerry's analysis from that time said that the threat actors behind RomCom follow a rather globalized targeting approach, highlighting that Cuba ransomware has never inclined towards hacktivism.
In November 2022, the cybersecurity firm discovered a new RomCom campaign that abused software brands and used fake sites in English and Ukrainian to target unsuspecting victims with malicious installers.
The final step of the attack is to load the RomCom backdoor on the machine, which arrives in the form of an x64 DLL file named 'Calc.exe.
RomCom malware spread via Google Ads for ChatGPT, GIMP, more.
News URL
Related news
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail (source)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)
- Google says hackers abuse Gemini AI to empower their attacks (source)
- How to Prevent Phishing Attacks with Multi-Factor Authentication (source)
- Suspected NATO, UN, US Army hacker arrested in Spain (source)
- Hacker pleads guilty to SIM swap attack on US SEC X account (source)
- whoAMI attacks give hackers code execution on Amazon EC2 instances (source)
- Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts (source)