File · RomCom · Unknown · assessed origin Russia · misp-galaxy · refreshed 2026-10-06
RomCom
- Storm-0978
- UAT-5647
sigil · no ATT&CK coverage stated
Analyst brief
misp-galaxyROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders. The ROMCOM backdoor is capable of stealing sensitive information and deploying other malware, showcasing the group's adaptability and growing sophistication.
Observed targets (as stated by the sources)
1 countries · 0 sectorsassessed origin · Russiaobserved targets · 1
countries · 1
- Germany
as stated by MISP galaxy / ransomware.live — not inferred
Detections
9 rules · Sigma · QRadar · CortexIndicator
Known-malicious file hash observedAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Malicious HashesAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Generated by skopnix from this finding, each with false-positive notes. Open the list →
Take it with you
keyless · no signupReferences
8 sources- 1.blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass
- 2.blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-p…
- 3.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders…
- 4.labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story
- 5.blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities…
- 6.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdo…
- 7.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherh…
- 8.blog.talosintelligence.com/uat-5647-romcom
Track RomCom on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.