Thursday, June 13, 2024

RomCom Threat Actor Uses Weaponized Microsoft Word File to Deliver Malware

RomCom is a RAT – that enables remote access/control over devices to exfiltrate sensitive information for financial gain, now being used in geo politically-motivated attacks against Ukraine’s military institutions.

 According to the Blackberry threat intelligence team, the threat actor targets NATO Submit guests through RTF  Exploitation.

Threat actors took advantage of this event and sent malicious documents impersonating Ukraine congress to the supporters of Ukraine.


Lithuania is hosting a NATO Summit in Vilnius on July 11-12. The presence of the President of Ukraine Zelenskyy was confirmed and will be having a discussion of membership with Ukraine in the future.

The threat actors cloned the website of the Ukraine Congress by adding the “.info” suffix to look legitimate.

Fig: Cloned fake website

Using the typosquatting Technique, they have created a fake domain ukrainianworldcongress[.]info which looks like the original domain ukrainianworldcongress[.]org.

Then, the Spear phishing technique is used to spread the malicious document “Overview_of_UWCs_UkraineInNATO_campaign.docx” containing an embedded RTF file named afchunk.rtf to the victims

Fig: Word document sent through phishing

Once the document gets executed by the user, it will connect to proxies services and run SMP and HTTPS ports.

The OLE object in the RTF file renders Iframe tags to download additional files to execute the attack.

The next stage of the attack is carried out by exploiting the vulnerability CVE-2022-30190 in the victim’s machine.

It is a zero-day vulnerability affecting Microsoft’s Support Diagnostic Tool (MSDT)  with freely available proof of concept (POC) exploit code appearing in the wild.

Through malicious document files, this vulnerability could be exploited by remote code exploitation attempts which leverage the additional payloads.

After the sequence of scripts starts the final payload—RomCom downloader—the file connects to the remote server to register the new victim, according to the report.

When the payload is successfully downloaded, the RomCom downloader starts the Windows service.

The RomCom downloader also collects information about the system on which it is running. Such as:

  • The size of the device’s RAM
  • Username
  • Information about the machine’s network adapter.

Indicator of compromise

SHA256- A61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f

“AI-based email security measures Protect your business From Email Threats!” – .


Latest articles

CISA Warns of Scammers Impersonating as CISA Employees

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a surge...

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges

Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088.With a CVSS score of 8.8, this flaw affects Microsoft...

256,000+ Publicly Exposed Windows Servers Vulnerable to MSMQ RCE Flaw

Cybersecurity watchdog Shadowserver has identified 256,000+ publicly exposed servers vulnerable to a critical Remote...

Indian National Jailed For Hacked Servers Of Company That Fired Him

An Indian national was sentenced to two years and eight months in jail for...

JetBrains Warns of GitHub Plugin that Exposes Access Tokens

A critical vulnerability (CVE-2024-37051) in the JetBrains GitHub plugin for IntelliJ-based IDEs (2023.1 and...

Critical Flaw In Apple Ecosystems Let Attackers Gain Unauthorized Access

Hackers go for Apple due to its massive user base along with rich customers,...

Hackers Exploiting Linux SSH Services to Deploy Malware

SSH and RDP provide remote access to server machines (Linux and Windows respectively) for...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles