By 
Threat actors named 'RomCom' have been suspected of phishing attacks targeting organizations supporting Ukraine and guests of the NATO Summit held in Vilnius, Lithuania.
Two malicious documents were discovered by BlackBerry's research and intelligence team, which impersonated the Ukrainian World Congress organization and topics related to the NATO Summit to lure selected targets.
The attackers used a replica of the Ukrainian World Congress website hosted on an ".info" domain instead of the real one that uses an ".org" top-level domain.
The downloaded documents contain malicious code that exploits the RTF file format to initiate connections to external resources, eventually loading malware onto the victim's system.
RomCom malware was first discovered by Unit 42 last year, who linked it to a Cuba Ransomware affiliate, an assessment that the Computer Emergency Response Team of Ukraine (CERT-UA) agreed with based on an October 2022 report.
However, as per BlackBerry's analysis, the threat actors behind RomCom follow a rather globalized targeting approach, highlighting that Cuba ransomware has never inclined towards hacktivism.
In November 2022, the cybersecurity firm discovered a new RomCom campaign that abused software brands and used fake sites in English and Ukrainian to target unsuspecting victims with malicious installers.
In May 2023, a report from Trend Micro on RomCom's latest campaign showed that the threat actors were now impersonating legitimate software like Gimp and ChatGPT or creating fake software developer sites to push their backdoor to victims through Google Ads and black SEO techniques.
The latest campaign that BlackBerry analyzed uses download links on a typo-squatted domain for the Ukrainian World Congress site, likely promoted via spear-phishing, to infect visitors with malware.
The documents downloaded from the fake website initiate an outbound connection upon launch and download additional components from the attacker's command and control (C2) server.
The additional component observed during the research is a script utilizing the Follina (CVE-2022-30190) vulnerability from Microsoft's Support Diagnostic Tool (MSDT).
If successfully exploited, it allows an attacker to conduct a remote code execution (RCE)-based attack. Finally, the RomCom backdoor is loaded on the machine, which arrives in the form of an x64 DLL file named 'Calc.exe.'
RomCom connects to the C2 to register the victim and sends back details such as username, network adapter info, and RAM size of the compromised computer.
BlackBerry believes that the analyzed campaign is either a rebranded RomCom operation or one that includes core members from the old group that support new threat activity.
