Skip to content
skopnix
Adversaries · Dossier
← Adversaries

File · RomCom · Unknown · assessed origin Russia · misp-galaxy · refreshed 2026-10-06

RomCom

  • Storm-0978
  • UAT-5647

sigil · no ATT&CK coverage stated

Analyst brief

misp-galaxy

ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders. The ROMCOM backdoor is capable of stealing sensitive information and deploying other malware, showcasing the group's adaptability and growing sophistication.

Observed targets (as stated by the sources)

1 countries · 0 sectors
GermanyAssessed origin: Russia

assessed origin · Russiaobserved targets · 1

countries · 1

  • Germany

as stated by MISP galaxy / ransomware.live — not inferred

Detections

9 rules · Sigma · QRadar · Cortex

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

8 sources
  1. 1.blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass
  2. 2.blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-p…
  3. 3.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders…
  4. 4.labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story
  5. 5.blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities…
  6. 6.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdo…
  7. 7.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherh…
  8. 8.blog.talosintelligence.com/uat-5647-romcom

Track RomCom on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.