RomCom Threat Actor Uses Weaponized Microsoft Word File to Deliver Malware

RomCom is a RAT – that enables remote access/control over devices to exfiltrate sensitive information for financial gain, now being used in geo politically-motivated attacks against Ukraine’s military institutions.

 According to the Blackberry threat intelligence team, the threat actor targets NATO Submit guests through RTF  Exploitation.

Threat actors took advantage of this event and sent malicious documents impersonating Ukraine congress to the supporters of Ukraine.

Exploitation

Lithuania is hosting a NATO Summit in Vilnius on July 11-12. The presence of the President of Ukraine Zelenskyy was confirmed and will be having a discussion of membership with Ukraine in the future.

The threat actors cloned the website of the Ukraine Congress by adding the “.info” suffix to look legitimate.

Fig: Cloned fake website

Using the typosquatting Technique, they have created a fake domain ukrainianworldcongress[.]info which looks like the original domain ukrainianworldcongress[.]org.

Then, the Spear phishing technique is used to spread the malicious document “Overview_of_UWCs_UkraineInNATO_campaign.docx” containing an embedded RTF file named afchunk.rtf to the victims

Fig: Word document sent through phishing

Once the document gets executed by the user, it will connect to proxies services and run SMP and HTTPS ports.

The OLE object in the RTF file renders Iframe tags to download additional files to execute the attack.

The next stage of the attack is carried out by exploiting the vulnerability CVE-2022-30190 in the victim’s machine.

It is a zero-day vulnerability affecting Microsoft’s Support Diagnostic Tool (MSDT)  with freely available proof of concept (POC) exploit code appearing in the wild.

Through malicious document files, this vulnerability could be exploited by remote code exploitation attempts which leverage the additional payloads.

After the sequence of scripts starts the final payload—RomCom downloader—the file connects to the remote server to register the new victim, according to the report.

When the payload is successfully downloaded, the RomCom downloader starts the Windows service.

The RomCom downloader also collects information about the system on which it is running. Such as:

  • The size of the device’s RAM
  • Username
  • Information about the machine’s network adapter.

Indicator of compromise

SHA256- A61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f
SHA256-3a3138c5add59d2172ad33bc6761f2f82ba344f3d03a2269c623f22c1a35df97
SHA256-e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539
SHA256-07377209fe68a98e9bca310d9749daa4eb79558e9fc419cf0b02a9e37679038d

“AI-based email security measures Protect your business From Email Threats!” – .

Sujatha

Recent Posts

Hackers Exploit NFC Technology to Steal Money from ATMs and POS Terminals

In a disturbing trend, cybercriminals, predominantly from Chinese underground networks, are exploiting Near Field Communication…

8 hours ago

Threat Actors Leverage TAG-124 Infrastructure to Deliver Malicious Payloads

In a concerning trend for cybersecurity, multiple threat actors, including ransomware groups and state-sponsored entities,…

8 hours ago

Ransomware Actors Ramp Up Attacks Organizations with Emerging Extortion Trends

Unit 42’s 2025 Global Incident Response Report, ransomware actors are intensifying their cyberattacks, with 86%…

8 hours ago

New SMS Phishing Attack Weaponizes Google AMP Links to Evade Detection

Group-IB’s High-Tech Crime Trends Report 2025 reveals a sharp 22% surge in phishing websites, with…

8 hours ago

Russian Hackers Exploit Microsoft OAuth 2.0 to Target Organizations

Cybersecurity firm Volexity has tracked a series of highly targeted attacks by suspected Russian threat…

8 hours ago

Hackers Weaponize Google Forms to Bypass Email Security and Steal Login Credentials

Threat actors are increasingly leveraging Google Forms, the tech giant’s widely-used form and quiz-building tool,…

10 hours ago