RomCom Threat Actor Uses Weaponized Microsoft Word File to Deliver Malware

RomCom is a RAT – that enables remote access/control over devices to exfiltrate sensitive information for financial gain, now being used in geo politically-motivated attacks against Ukraine’s military institutions.

 According to the Blackberry threat intelligence team, the threat actor targets NATO Submit guests through RTF  Exploitation.

Threat actors took advantage of this event and sent malicious documents impersonating Ukraine congress to the supporters of Ukraine.

Exploitation

Lithuania is hosting a NATO Summit in Vilnius on July 11-12. The presence of the President of Ukraine Zelenskyy was confirmed and will be having a discussion of membership with Ukraine in the future.

The threat actors cloned the website of the Ukraine Congress by adding the “.info” suffix to look legitimate.

Fig: Cloned fake website

Using the typosquatting Technique, they have created a fake domain ukrainianworldcongress[.]info which looks like the original domain ukrainianworldcongress[.]org.

Then, the Spear phishing technique is used to spread the malicious document “Overview_of_UWCs_UkraineInNATO_campaign.docx” containing an embedded RTF file named afchunk.rtf to the victims

Fig: Word document sent through phishing

Once the document gets executed by the user, it will connect to proxies services and run SMP and HTTPS ports.

The OLE object in the RTF file renders Iframe tags to download additional files to execute the attack.

The next stage of the attack is carried out by exploiting the vulnerability CVE-2022-30190 in the victim’s machine.

It is a zero-day vulnerability affecting Microsoft’s Support Diagnostic Tool (MSDT)  with freely available proof of concept (POC) exploit code appearing in the wild.

Through malicious document files, this vulnerability could be exploited by remote code exploitation attempts which leverage the additional payloads.

After the sequence of scripts starts the final payload—RomCom downloader—the file connects to the remote server to register the new victim, according to the report.

When the payload is successfully downloaded, the RomCom downloader starts the Windows service.

The RomCom downloader also collects information about the system on which it is running. Such as:

  • The size of the device’s RAM
  • Username
  • Information about the machine’s network adapter.

Indicator of compromise

SHA256- A61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f
SHA256-3a3138c5add59d2172ad33bc6761f2f82ba344f3d03a2269c623f22c1a35df97
SHA256-e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539
SHA256-07377209fe68a98e9bca310d9749daa4eb79558e9fc419cf0b02a9e37679038d

“AI-based email security measures Protect your business From Email Threats!” – .

Sujatha

Recent Posts

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has…

5 hours ago

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a…

5 hours ago

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,”…

5 hours ago

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear phishing…

6 hours ago

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update…

9 hours ago

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…

10 hours ago