Security News > 2023 > July > RomCom hackers target NATO Summit attendees in phishing attacks
A threat actor referred to as 'RomCom' has been targeting organizations supporting Ukraine and guests of the upcoming NATO Summit set to start tomorrow in Vilnius, Lithuania.
BlackBerry's research and intelligence team recently discovered two malicious documents that impersonated the Ukranian World Congress organization and topics related to the NATO Summit to lure selected targets.
BlackBerry's analysis from that time said that the threat actors behind RomCom follow a rather globalized targeting approach, highlighting that Cuba ransomware has never inclined towards hacktivism.
In November 2022, the cybersecurity firm discovered a new RomCom campaign that abused software brands and used fake sites in English and Ukrainian to target unsuspecting victims with malicious installers.
The final step of the attack is to load the RomCom backdoor on the machine, which arrives in the form of an x64 DLL file named 'Calc.exe.
RomCom malware spread via Google Ads for ChatGPT, GIMP, more.
News URL
Related news
- Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks (source)
- APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme (source)
- New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT (source)
- New StrelaStealer Phishing Attacks Hit Over 100 Organizations in E.U. and U.S. (source)
- Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks (source)
- Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others (source)
- US sanctions APT31 hackers behind critical infrastructure attacks (source)
- Alert: New Phishing Attack Delivers Keylogger Disguised as Bank Payment Notice (source)
- Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack (source)
- TA547 Phishing Attack Hits German Firms with Rhadamanthys Stealer (source)